Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
NotaFiscalOnline.ClientSetup.ex#.exe

Overview

General Information

Sample name:NotaFiscalOnline.ClientSetup.ex#.exe
Analysis ID:1579141
MD5:6172d1fc5570bc73675ba4dd05772a6e
SHA1:407aa98fe89d23a8b0fd3b9f448ee11bcf028c41
SHA256:564370d9522a479a4ed5c2a9b18f66e289e51e2dbf3ce3920fc3e0ad99e25046
Tags:exeuser-500mk500
Infos:

Detection

ScreenConnect Tool
Score:63
Range:0 - 100
Whitelisted:false
Confidence:100%

Compliance

Score:33
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
.NET source code references suspicious native API functions
AI detected suspicious sample
Contains functionality to hide user accounts
Detected potential unwanted application
Enables network access during safeboot for specific services
Modifies security policies related information
Possible COM Object hijacking
Reads the Security eventlog
Reads the System eventlog
Allocates memory with a write watch (potentially for evading sandboxes)
Checks for available system drives (often done to infect USB drives)
Contains functionality to launch a process as a different user
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates or modifies windows services
Deletes files inside the Windows folder
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
EXE planting / hijacking vulnerabilities found
Enables debug privileges
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
May sleep (evasive loops) to hinder dynamic analysis
May use bcdedit to modify the Windows boot settings
Modifies existing windows services
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected ScreenConnect Tool

Classification

Process Tree

  • System is w10x64
  • NotaFiscalOnline.ClientSetup.ex#.exe (PID: 6448 cmdline: "C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exe" MD5: 6172D1FC5570BC73675BA4DD05772A6E)
    • msiexec.exe (PID: 6668 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ScreenConnect\24.3.7.9067\bc180d8c7278c2c2\ScreenConnect.ClientSetup.msi" MD5: 9D09DC1EDA745A5F87553048E57620CF)
  • msiexec.exe (PID: 6764 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)
    • msiexec.exe (PID: 6896 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 01AE97C6828A00B62856E6DBA863F62A C MD5: 9D09DC1EDA745A5F87553048E57620CF)
      • rundll32.exe (PID: 7040 cmdline: rundll32.exe "C:\Users\user\AppData\Local\Temp\MSI2520.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_6628765 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments MD5: 889B99C52A60DD49227C5E485A016679)
    • msiexec.exe (PID: 3320 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 631DC54B678986F45EC3DD437FC857A0 MD5: 9D09DC1EDA745A5F87553048E57620CF)
    • msiexec.exe (PID: 4228 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding DA995B7CADCB555D52A21FB927C287F4 E Global\MSI0000 MD5: 9D09DC1EDA745A5F87553048E57620CF)
  • ScreenConnect.ClientService.exe (PID: 2172 cmdline: "C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-moi41i-relay.screenconnect.com&p=443&s=c0ccf19a-72f4-49f1-916b-7723f411f3c8&k=BgIAAACkAABSU0ExAAgAAAEAAQCtUXkVr37HxSNSKxbtVhrTqFy7qJEmo6oCjc91wFOvR4MUBL0kG%2fPw0Y6O4Cbp7p%2bPwDDGLRq%2fNEgwH7S00d6wq1MfdBFm9Uj%2f4fypFZ638LE3OcnK3GXv9nhEoZ1FF8a9u5e0J2AODxPEA5zAmcZC%2b7QZoOfCFaWBpymeq6yYlchLnp1mxk8YwdX7eUAaEm9dE2I95SghGZoVVq0fNyXOlQyIf5EHMgY9Z1LVbVieXeSWVl3znzwAO%2f2y0TpiXGxUUGXL5LRto6Is%2bwKhhKCzwCy3hm8ZX1L10%2fafGHE8wmaJEDg1ddSksTCut%2fYCxPRx7MSQDUTkMhfPMZ4NO3HW" MD5: 75B21D04C69128A7230A0998086B61AA)
    • ScreenConnect.WindowsClient.exe (PID: 7104 cmdline: "C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exe" "RunRole" "7287b599-81b8-4cbc-8966-5e6b6b8ab1f8" "User" MD5: 1778204A8C3BC2B8E5E4194EDBAF7135)
  • svchost.exe (PID: 7092 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
NotaFiscalOnline.ClientSetup.ex#.exeJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security

    Dropped Files

    SourceRuleDescriptionAuthorStrings
    C:\Windows\Temp\~DF31A1C5F44E3BDC22.TMPJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
      C:\Windows\Temp\~DF3ACDD70DD54C3FFA.TMPJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
        C:\Windows\Installer\inprogressinstallinfo.ipiJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
          C:\Config.Msi\652b3c.rbsJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
            C:\Windows\Temp\~DFDC109B3E936D4CFB.TMPJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
              Click to see the 5 entries

              Memory Dumps

              SourceRuleDescriptionAuthorStrings
              00000000.00000002.1720978268.0000000005C40000.00000004.08000000.00040000.00000000.sdmpJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                00000008.00000000.1742944760.0000000000952000.00000002.00000001.01000000.00000011.sdmpJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                  00000008.00000002.2935287983.0000000002CF1000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                    00000000.00000000.1682451497.0000000000326000.00000002.00000001.01000000.00000003.sdmpJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                      Process Memory Space: NotaFiscalOnline.ClientSetup.ex#.exe PID: 6448JoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                        Click to see the 2 entries

                        Unpacked PEs

                        SourceRuleDescriptionAuthorStrings
                        8.0.ScreenConnect.WindowsClient.exe.950000.0.unpackJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                          0.2.NotaFiscalOnline.ClientSetup.ex#.exe.5c40000.13.raw.unpackJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                            8.2.ScreenConnect.WindowsClient.exe.2d6fa10.5.raw.unpackJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                              0.2.NotaFiscalOnline.ClientSetup.ex#.exe.5c40000.13.unpackJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                                0.0.NotaFiscalOnline.ClientSetup.ex#.exe.3ac3d4.1.raw.unpackJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                                  Click to see the 3 entries

                                  Sigma Signatures

                                  System Summary

                                  barindex
                                  Sigma detected: Windows Processes Suspicious Parent Directory
                                  Source: Process startedAuthor: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7092, ProcessName: svchost.exe

                                  Suricata Signatures

                                  ⊘No Suricata rule has matched

                                  Joe Sandbox Signatures

                                  Click to jump to signature section

                                  Show All Signature Results

                                  AV Detection

                                  barindex
                                  Multi AV Scanner detection for submitted file
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeReversingLabs: Detection: 18%
                                  AI detected suspicious sample
                                  Source: Submited SampleIntegrated Neural Analysis Model: Matched 92.6% probability
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_045F0E88 CryptProtectData,7_2_045F0E88
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_045F1670 CryptProtectData,7_2_045F1670
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeEXE: msiexec.exeJump to behavior

                                  Compliance

                                  barindex
                                  EXE planting / hijacking vulnerabilities found
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeEXE: msiexec.exeJump to behavior
                                  Uses 32bit PE files
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                                  Creates install or setup log file
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NotaFiscalOnline.ClientSetup.ex#.exe.logJump to behavior
                                  PE / OLE file has a valid certificate
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: certificate valid
                                  Contains modern PE file flags such as dynamic base (ASLR) or NX
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                  Binary contains paths to debug symbols
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb source: ScreenConnect.WindowsFileManager.exe.2.dr
                                  Source: Binary string: e089\mscorlib.pdb source: ScreenConnect.ClientService.exe, 00000007.00000002.2956390262.00000000054B0000.00000004.00000020.00020000.00000000.sdmp
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientInstallerRunner\obj\Release\ScreenConnect.ClientInstallerRunner.pdb source: NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsInstaller\obj\Release\net20\ScreenConnect.WindowsInstaller.pdbM source: NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: Binary string: System.pdbN|2h|2 Z|2_CorDllMainmscoree.dll source: ScreenConnect.ClientService.exe, 00000007.00000002.2956390262.00000000054F7000.00000004.00000020.00020000.00000000.sdmp
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsInstaller\obj\Release\net20\ScreenConnect.WindowsInstaller.pdb source: NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdbT source: Microsoft.Deployment.WindowsInstaller.dll.4.dr
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.2.dr
                                  Source: Binary string: \??\C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Client.PDB source: ScreenConnect.ClientService.exe, 00000007.00000002.2931238888.00000000013B7000.00000004.00000020.00020000.00000000.sdmp
                                  Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller.Package\Microsoft.Deployment.WindowsInstaller.Package.pdb source: Microsoft.Deployment.WindowsInstaller.Package.dll.4.dr
                                  Source: Binary string: C:\Compile\screenconnect\Product\WindowsAuthenticationPackage\bin\Release\ScreenConnect.WindowsAuthenticationPackage.pdb source: ScreenConnect.ClientService.exe, 00000007.00000002.2949999548.0000000003067000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.2945675574.0000000012D00000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.2.dr
                                  Source: Binary string: System.pdb source: ScreenConnect.ClientService.exe, 00000007.00000002.2956390262.00000000054F7000.00000004.00000020.00020000.00000000.sdmp
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: NotaFiscalOnline.ClientSetup.ex#.exe, ScreenConnect.Core.dll.4.dr, ScreenConnect.Core.dll.2.dr
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: ScreenConnect.WindowsClient.exe, 00000008.00000002.2933702877.0000000001302000.00000002.00000001.01000000.0000000D.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.2933117951.0000000001260000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.2935287983.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.dll.2.dr
                                  Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\DotNetResolver\obj\Debug\DotNetResolver.pdb source: NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 00000007.00000000.1723067436.000000000058D000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.ClientService.exe.2.dr
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: NotaFiscalOnline.ClientSetup.ex#.exe, ScreenConnect.Windows.dll.2.dr
                                  Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\Compression.Cab\Microsoft.Deployment.Compression.Cab.pdb source: rundll32.exe, 00000004.00000003.1699620917.0000000004A35000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1708448418.00000000048C0000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.Cab.dll.4.dr
                                  Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdb source: Microsoft.Deployment.WindowsInstaller.dll.4.dr
                                  Source: Binary string: \??\C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Core.pdb source: ScreenConnect.ClientService.exe, 00000007.00000002.2931238888.00000000013B7000.00000004.00000020.00020000.00000000.sdmp
                                  Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: ScreenConnect.ClientService.exe, 00000007.00000002.2931238888.00000000013B7000.00000004.00000020.00020000.00000000.sdmp
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\InstallerActions\obj\Release\net20\ScreenConnect.InstallerActions.pdb source: ScreenConnect.InstallerActions.dll.4.dr
                                  Source: Binary string: C:\build\work\eca3d12b\wix3\build\ship\x86\wixca.pdb source: NotaFiscalOnline.ClientSetup.ex#.exe, MSI2FC1.tmp.2.dr, MSI2D9C.tmp.2.dr, MSI2DDC.tmp.2.dr, 652b3d.msi.2.dr, 652b3c.rbs.2.dr, ScreenConnect.ClientSetup.msi.0.dr, 652b3b.msi.2.dr
                                  Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\Compression\Microsoft.Deployment.Compression.pdb source: rundll32.exe, 00000004.00000003.1699620917.00000000049C6000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.dll.4.dr
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdbS] source: NotaFiscalOnline.ClientSetup.ex#.exe, ScreenConnect.Windows.dll.2.dr
                                  Source: Binary string: screenconnect_windows_credential_provider.pdb source: ScreenConnect.ClientService.exe, 00000007.00000002.2949999548.0000000003067000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.2945675574.0000000012D00000.00000004.00000800.00020000.00000000.sdmp
                                  Source: Binary string: \??\C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Client.pdb source: ScreenConnect.ClientService.exe, 00000007.00000002.2931238888.00000000013B7000.00000004.00000020.00020000.00000000.sdmp
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000008.00000000.1742944760.0000000000952000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.WindowsClient.exe.2.dr
                                  Source: Binary string: E:\delivery\Dev\wix37_public\build\ship\x86\SfxCA.pdb source: NotaFiscalOnline.ClientSetup.ex#.exe, 652b3d.msi.2.dr, ScreenConnect.ClientSetup.msi.0.dr, 652b3b.msi.2.dr, MSI2520.tmp.1.dr
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdbi source: ScreenConnect.ClientService.exe, 00000007.00000002.2956390262.00000000054F7000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.2933268506.0000000001282000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Client.dll.2.dr
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdbu source: ScreenConnect.WindowsClient.exe, 00000008.00000000.1742944760.0000000000952000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.WindowsClient.exe.2.dr
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: ScreenConnect.ClientService.exe, 00000007.00000002.2956390262.00000000054F7000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.2933268506.0000000001282000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Client.dll.2.dr
                                  Source: Binary string: screenconnect_windows_credential_provider.pdb' source: ScreenConnect.ClientService.exe, 00000007.00000002.2949999548.0000000003067000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.2945675574.0000000012D00000.00000004.00000800.00020000.00000000.sdmp
                                  Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetRunner.pdb source: NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbd source: ScreenConnect.ClientService.exe, 00000007.00000002.2931238888.00000000013B7000.00000004.00000020.00020000.00000000.sdmp
                                  Source: C:\Windows\System32\msiexec.exeFile opened: z:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: x:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: v:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: t:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: r:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: p:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: n:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: l:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: j:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: h:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: f:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: b:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: y:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: w:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: u:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: s:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: q:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: o:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: m:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: k:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: i:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: g:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: e:Jump to behavior
                                  Source: C:\Windows\System32\svchost.exeFile opened: c:
                                  Source: C:\Windows\System32\msiexec.exeFile opened: a:Jump to behavior

                                  Networking

                                  barindex
                                  Enables network access during safeboot for specific services
                                  Source: C:\Windows\System32\msiexec.exeRegistry value created: NULL ServiceJump to behavior
                                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                                  Source: global trafficDNS traffic detected: DNS query: instance-moi41i-relay.screenconnect.com
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsAuthenticationPackage.dll.2.dr, ScreenConnect.WindowsClient.exe.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.2945675574.0000000012D00000.00000004.00000800.00020000.00000000.sdmp, NotaFiscalOnline.ClientSetup.ex#.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsAuthenticationPackage.dll.2.dr, ScreenConnect.WindowsClient.exe.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsAuthenticationPackage.dll.2.dr, ScreenConnect.WindowsClient.exe.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsAuthenticationPackage.dll.2.dr, ScreenConnect.WindowsClient.exe.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
                                  Source: svchost.exe, 00000009.00000002.2934511786.000002AE91C85000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.ver)
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsAuthenticationPackage.dll.2.dr, ScreenConnect.WindowsClient.exe.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsAuthenticationPackage.dll.2.dr, ScreenConnect.WindowsClient.exe.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsAuthenticationPackage.dll.2.dr, ScreenConnect.WindowsClient.exe.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
                                  Source: ScreenConnect.WindowsClient.exe.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.2945675574.0000000012D00000.00000004.00000800.00020000.00000000.sdmp, NotaFiscalOnline.ClientSetup.ex#.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsAuthenticationPackage.dll.2.dr, ScreenConnect.WindowsClient.exe.2.drString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
                                  Source: svchost.exe, 00000009.00000003.1759022264.000002AE91E18000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
                                  Source: edb.log.9.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
                                  Source: edb.log.9.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
                                  Source: edb.log.9.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
                                  Source: svchost.exe, 00000009.00000003.1759022264.000002AE91E18000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
                                  Source: svchost.exe, 00000009.00000003.1759022264.000002AE91E18000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
                                  Source: svchost.exe, 00000009.00000003.1759022264.000002AE91E4D000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
                                  Source: edb.log.9.drString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
                                  Source: ScreenConnect.ClientService.exe, 00000007.00000002.2931238888.000000000143C000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.2935236379.000000000237E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://instance-moi41i-relay.screenconnect.com:443/
                                  Source: ScreenConnect.ClientService.exe, 00000007.00000002.2931238888.000000000143C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://instance-moi41i-relay.screenconnect.com:443/)T
                                  Source: ScreenConnect.ClientService.exe, 00000007.00000002.2931238888.000000000143C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://instance-moi41i-relay.screenconnect.com:443/-
                                  Source: ScreenConnect.ClientService.exe, 00000007.00000002.2931238888.000000000143C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://instance-moi41i-relay.screenconnect.com:443/?
                                  Source: ScreenConnect.ClientService.exe, 00000007.00000002.2935236379.0000000002552000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.2935236379.0000000002237000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.2935236379.000000000237E000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.2935236379.000000000218E000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.2935236379.0000000002422000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.2935236379.00000000021BA000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.2935236379.0000000002525000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.2935236379.00000000022DD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://instance-moi41i-relay.screenconnect.com:443/d
                                  Source: ScreenConnect.ClientService.exe, 00000007.00000002.2931238888.000000000143C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://instance-moi41i-relay.screenconnect.com:443/sT
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsAuthenticationPackage.dll.2.dr, ScreenConnect.WindowsClient.exe.2.drString found in binary or memory: http://ocsp.digicert.com0
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsAuthenticationPackage.dll.2.dr, ScreenConnect.WindowsClient.exe.2.drString found in binary or memory: http://ocsp.digicert.com0A
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsAuthenticationPackage.dll.2.dr, ScreenConnect.WindowsClient.exe.2.drString found in binary or memory: http://ocsp.digicert.com0C
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsAuthenticationPackage.dll.2.dr, ScreenConnect.WindowsClient.exe.2.drString found in binary or memory: http://ocsp.digicert.com0X
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000002.1694147938.0000000003231000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.2935236379.00000000020C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                                  Source: rundll32.exe, 00000004.00000003.1699620917.00000000049C6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1699620917.0000000004A35000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1699856745.00000000048C3000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.4.dr, Microsoft.Deployment.Compression.dll.4.dr, Microsoft.Deployment.Compression.Cab.dll.4.drString found in binary or memory: http://wixtoolset.org/Whttp://wixtoolset.org/telemetry/v
                                  Source: rundll32.exe, 00000004.00000003.1699620917.00000000049C6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1699620917.0000000004A35000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1699856745.00000000048C3000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.4.dr, Microsoft.Deployment.Compression.dll.4.dr, Microsoft.Deployment.Compression.Cab.dll.4.drString found in binary or memory: http://wixtoolset.org/news/
                                  Source: rundll32.exe, 00000004.00000003.1699620917.00000000049C6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1699620917.0000000004A35000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1699856745.00000000048C3000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.4.dr, Microsoft.Deployment.Compression.dll.4.dr, Microsoft.Deployment.Compression.Cab.dll.4.drString found in binary or memory: http://wixtoolset.org/releases/
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coml
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsAuthenticationPackage.dll.2.dr, ScreenConnect.WindowsClient.exe.2.drString found in binary or memory: http://www.digicert.com/CPS0
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fonts.com
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.goodfont.co.kr
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.com
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.com
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sandoll.co.kr
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.com
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.typography.netD
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.2945675574.0000000012D00000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
                                  Source: ScreenConnect.Core.dll.2.drString found in binary or memory: https://feedback.screenconnect.com/Feedback.axd
                                  Source: svchost.exe, 00000009.00000003.1759022264.000002AE91EC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.drString found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
                                  Source: edb.log.9.drString found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
                                  Source: edb.log.9.drString found in binary or memory: https://g.live.com/odclientsettings/ProdV2
                                  Source: edb.log.9.drString found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
                                  Source: svchost.exe, 00000009.00000003.1759022264.000002AE91EC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.drString found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
                                  Source: svchost.exe, 00000009.00000003.1759022264.000002AE91EC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.drString found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
                                  Source: edb.log.9.drString found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
                                  Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
                                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
                                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
                                  Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
                                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49840
                                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
                                  Source: unknownNetwork traffic detected: HTTP traffic on port 49840 -> 443
                                  Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
                                  Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
                                  Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
                                  Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
                                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
                                  Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
                                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
                                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
                                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
                                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
                                  Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443

                                  Spam, unwanted Advertisements and Ransom Demands

                                  barindex
                                  Reads the Security eventlog
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\ScreenConnectJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\ScreenConnectJump to behavior
                                  Reads the System eventlog
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\ScreenConnectJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior

                                  System Summary

                                  barindex
                                  Detected potential unwanted application
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exePE Siganture Subject Chain: CN="Connectwise, LLC", O="Connectwise, LLC", L=Tampa, S=Florida, C=US
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_05CD25C0 CreateProcessAsUserW,7_2_05CD25C0
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\652b3b.msiJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\inprogressinstallinfo.ipiJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\SourceHash{8ED2474F-3FEA-BB0F-7BE5-1BCA7E4AB8D2}Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI2D9C.tmpJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI2DDC.tmpJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI2FC1.tmpJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\652b3d.msiJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\652b3d.msiJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\{8ED2474F-3FEA-BB0F-7BE5-1BCA7E4AB8D2}Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\{8ED2474F-3FEA-BB0F-7BE5-1BCA7E4AB8D2}\DefaultIconJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeFile created: C:\Windows\Installer\wix{8ED2474F-3FEA-BB0F-7BE5-1BCA7E4AB8D2}.SchedServiceConfig.rmiJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)Jump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\2kgdghcx.tmpJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\2kgdghcx.newcfgJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\hsaej4wc.tmpJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\hsaej4wc.newcfgJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\kyp4jwo2.tmpJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\kyp4jwo2.newcfgJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\2quoghav.tmpJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\2quoghav.newcfgJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\m0qq0kbb.tmpJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\m0qq0kbb.newcfgJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\rqtlytpw.tmpJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\rqtlytpw.newcfgJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\hudqk2hi.tmpJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\hudqk2hi.newcfgJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\jtdl3m1a.tmpJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\jtdl3m1a.newcfgJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\fm0i4g4x.tmpJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\fm0i4g4x.newcfgJump to behavior
                                  Source: C:\Windows\System32\svchost.exeFile created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
                                  Source: C:\Windows\System32\msiexec.exeFile deleted: C:\Windows\Installer\MSI2DDC.tmpJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeCode function: 0_2_05B087B80_2_05B087B8
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeCode function: 0_2_05B0BA200_2_05B0BA20
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeCode function: 0_2_05B087A80_2_05B087A8
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeCode function: 0_2_05B20CB80_2_05B20CB8
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeCode function: 0_2_05B21E9B0_2_05B21E9B
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_05729D587_2_05729D58
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_05728C707_2_05728C70
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_05728C707_2_05728C70
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_05CD00407_2_05CD0040
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_05CD00407_2_05CD0040
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FFD9B4070088_2_00007FFD9B407008
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FFD9B4010D78_2_00007FFD9B4010D7
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FFD9B4010CF8_2_00007FFD9B4010CF
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FFD9B71704B8_2_00007FFD9B71704B
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FFD9B716BA48_2_00007FFD9B716BA4
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FFD9B7169918_2_00007FFD9B716991
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FFD9B718EF88_2_00007FFD9B718EF8
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FFD9B71B6B18_2_00007FFD9B71B6B1
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000002.1692670910.000000000143B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemsiexec.exe.muiX vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000002.1692670910.000000000143B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemsiexec.exeX vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000002.1694005496.00000000031F0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameDotNetResolver.exe4 vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000002.1720978268.0000000005DFC000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameScreenConnect.InstallerActions.dll< vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000002.1720978268.0000000005DFC000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameSfxCA.dllL vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000002.1720978268.0000000005DFC000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenamewixca.dll\ vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000002.1720978268.0000000005DFC000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameScreenConnect.ClientInstallerRunner.exe< vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000000.1682451497.000000000084F000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameScreenConnect.ClientInstallerRunner.exe< vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000000.1682451497.000000000084F000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameDotNetResolver.exe4 vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000002.1718685571.0000000005940000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenamelibwebp.dllB vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000002.1718685571.0000000005940000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenamezlib.dll2 vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000002.1718685571.0000000005940000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameScreenConnect.Windows.dll< vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000002.1708144944.00000000043F3000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameScreenConnect.Windows.dll< vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000002.1694049450.0000000003200000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameScreenConnect.WindowsInstaller.dll< vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000002.1717693582.0000000005740000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameScreenConnect.Core.dll< vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000002.1694147938.0000000003B1C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameScreenConnect.InstallerActions.dll< vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000002.1694147938.0000000003B1C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSfxCA.dllL vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000002.1694147938.0000000003B1C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewixca.dll\ vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000000.1682451497.0000000000326000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameScreenConnect.Core.dll< vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000000.1682451497.0000000000326000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamelibwebp.dllB vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000000.1682451497.0000000000326000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamezlib.dll2 vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000000.1682451497.0000000000326000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameScreenConnect.Windows.dll< vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000000.1682451497.0000000000326000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameScreenConnect.WindowsInstaller.dll< vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeBinary or memory string: OriginalFilenameScreenConnect.Core.dll< vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeBinary or memory string: OriginalFilenamelibwebp.dllB vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeBinary or memory string: OriginalFilenamezlib.dll2 vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeBinary or memory string: OriginalFilenameScreenConnect.Windows.dll< vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeBinary or memory string: OriginalFilenameScreenConnect.WindowsInstaller.dll< vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeBinary or memory string: OriginalFilenameScreenConnect.InstallerActions.dll< vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeBinary or memory string: OriginalFilenameSfxCA.dllL vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeBinary or memory string: OriginalFilenamewixca.dll\ vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeBinary or memory string: OriginalFilenameScreenConnect.ClientInstallerRunner.exe< vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeBinary or memory string: OriginalFilenameDotNetResolver.exe4 vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                                  Source: 0.2.NotaFiscalOnline.ClientSetup.ex#.exe.5740000.6.raw.unpack, CursorBuffer.csCryptographic APIs: 'TransformBlock'
                                  Source: 0.2.NotaFiscalOnline.ClientSetup.ex#.exe.5940000.8.raw.unpack, WindowsToolkit.csCryptographic APIs: 'CreateDecryptor'
                                  Source: 0.0.NotaFiscalOnline.ClientSetup.ex#.exe.3ac3d4.1.raw.unpack, WindowsToolkit.csCryptographic APIs: 'CreateDecryptor'
                                  Source: 0.0.NotaFiscalOnline.ClientSetup.ex#.exe.3ac3d4.1.raw.unpack, WindowsExtensions.csSecurity API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
                                  Source: 0.0.NotaFiscalOnline.ClientSetup.ex#.exe.3ac3d4.1.raw.unpack, WindowsExtensions.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                                  Source: 0.0.NotaFiscalOnline.ClientSetup.ex#.exe.3ac3d4.1.raw.unpack, WindowsExtensions.csSecurity API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
                                  Source: 0.2.NotaFiscalOnline.ClientSetup.ex#.exe.5940000.8.raw.unpack, WindowsExtensions.csSecurity API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
                                  Source: 0.2.NotaFiscalOnline.ClientSetup.ex#.exe.5940000.8.raw.unpack, WindowsExtensions.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                                  Source: 0.2.NotaFiscalOnline.ClientSetup.ex#.exe.5940000.8.raw.unpack, WindowsExtensions.csSecurity API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
                                  Source: classification engineClassification label: mal63.evad.winEXE@16/64@3/2
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)Jump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NotaFiscalOnline.ClientSetup.ex#.exe.logJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeMutant created: NULL
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeMutant created: \BaseNamedObjects\Global\netfxeventlog.1.0
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeFile created: C:\Users\user\AppData\Local\Temp\ScreenConnectJump to behavior
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSI2520.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_6628765 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeReversingLabs: Detection: 18%
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeString found in binary or memory: $F294ACFC-3146-4483-A7BF-ADDCA7C260E2
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeString found in binary or memory: $F294ACFC-3146-4483-A7BF-ADDCA7C260E2)
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeFile read: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeJump to behavior
                                  Source: unknownProcess created: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exe "C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exe"
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ScreenConnect\24.3.7.9067\bc180d8c7278c2c2\ScreenConnect.ClientSetup.msi"
                                  Source: unknownProcess created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
                                  Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 01AE97C6828A00B62856E6DBA863F62A C
                                  Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSI2520.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_6628765 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                                  Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 631DC54B678986F45EC3DD437FC857A0
                                  Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding DA995B7CADCB555D52A21FB927C287F4 E Global\MSI0000
                                  Source: unknownProcess created: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe "C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-moi41i-relay.screenconnect.com&p=443&s=c0ccf19a-72f4-49f1-916b-7723f411f3c8&k=BgIAAACkAABSU0ExAAgAAAEAAQCtUXkVr37HxSNSKxbtVhrTqFy7qJEmo6oCjc91wFOvR4MUBL0kG%2fPw0Y6O4Cbp7p%2bPwDDGLRq%2fNEgwH7S00d6wq1MfdBFm9Uj%2f4fypFZ638LE3OcnK3GXv9nhEoZ1FF8a9u5e0J2AODxPEA5zAmcZC%2b7QZoOfCFaWBpymeq6yYlchLnp1mxk8YwdX7eUAaEm9dE2I95SghGZoVVq0fNyXOlQyIf5EHMgY9Z1LVbVieXeSWVl3znzwAO%2f2y0TpiXGxUUGXL5LRto6Is%2bwKhhKCzwCy3hm8ZX1L10%2fafGHE8wmaJEDg1ddSksTCut%2fYCxPRx7MSQDUTkMhfPMZ4NO3HW"
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess created: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exe "C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exe" "RunRole" "7287b599-81b8-4cbc-8966-5e6b6b8ab1f8" "User"
                                  Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ScreenConnect\24.3.7.9067\bc180d8c7278c2c2\ScreenConnect.ClientSetup.msi"Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 01AE97C6828A00B62856E6DBA863F62A CJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 631DC54B678986F45EC3DD437FC857A0Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding DA995B7CADCB555D52A21FB927C287F4 E Global\MSI0000Jump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSI2520.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_6628765 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArgumentsJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess created: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exe "C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exe" "RunRole" "7287b599-81b8-4cbc-8966-5e6b6b8ab1f8" "User"Jump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: apphelp.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: mscoree.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: kernel.appcore.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: wldp.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: amsi.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: userenv.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: profapi.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: version.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: msasn1.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: gpapi.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: cryptsp.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: rsaenh.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: cryptbase.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: uxtheme.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: windows.storage.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: propsys.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: edputil.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: urlmon.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: iertutil.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: srvcli.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: netutils.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: sspicli.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: wintypes.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: appresolver.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: bcp47langs.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: slc.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: sppc.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: apphelp.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: aclayers.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mpr.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msi.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: srpapi.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: tsappcmp.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: uxtheme.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: textinputframework.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: coreuicomponents.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: coremessaging.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: ntmarta.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wintypes.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wintypes.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wintypes.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: windows.storage.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wldp.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: propsys.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: textshaping.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: netapi32.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wkscli.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: netutils.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: version.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mscoree.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: profapi.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sspicli.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msihnd.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: pcacli.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: apphelp.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: aclayers.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: sfc.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: msi.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: tsappcmp.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: userenv.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: profapi.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: sspicli.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: netapi32.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: wkscli.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: netutils.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: srclient.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: spp.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: powrprof.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: vssapi.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: vsstrace.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: umpdc.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: wldp.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: mscoree.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: version.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: rstrtmgr.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: ncrypt.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: ntasn1.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: windows.storage.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: pcacli.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: mpr.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: cabinet.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: apphelp.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: aclayers.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mpr.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msi.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: cabinet.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: apphelp.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: aclayers.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mpr.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msi.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: version.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: apphelp.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: aclayers.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mpr.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msi.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: version.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: apphelp.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: mscoree.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: kernel.appcore.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: cryptsp.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: rsaenh.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: cryptbase.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: urlmon.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: iertutil.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: srvcli.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: netutils.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: sspicli.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: windows.storage.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: wldp.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: propsys.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: version.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: profapi.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: dpapi.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: amsi.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: userenv.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: msasn1.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: gpapi.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: wtsapi32.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: winsta.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: netapi32.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: samcli.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: samlib.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: mswsock.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: dnsapi.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: iphlpapi.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: rasadhlp.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: fwpuclnt.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: dhcpcsvc6.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: dhcpcsvc.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: winnsi.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: rasapi32.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: rasman.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: rtutils.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: winhttp.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: ntmarta.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: mscoree.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: apphelp.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: kernel.appcore.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: version.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: uxtheme.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: cryptsp.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: rsaenh.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: cryptbase.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: windows.storage.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: wldp.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: profapi.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: amsi.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: userenv.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: urlmon.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: iertutil.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: srvcli.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: netutils.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: sspicli.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: propsys.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: windowscodecs.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: dwrite.dllJump to behavior
                                  Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: qmgr.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: bitsperf.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: firewallapi.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: esent.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: dnsapi.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: iphlpapi.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: fwbase.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: flightsettings.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: netprofm.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: bitsigd.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: upnp.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: ssdpapi.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: urlmon.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: iertutil.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: srvcli.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: appxdeploymentclient.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: wsmauto.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: miutils.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: wsmsvc.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: dsrole.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: pcwum.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: mi.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: gpapi.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: wkscli.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: msv1_0.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: ntlmshared.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: cryptdll.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: webio.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: mswsock.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: winnsi.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: fwpuclnt.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: rasadhlp.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: rmclient.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: usermgrcli.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: execmodelclient.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: propsys.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: coremessaging.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: twinapi.appcore.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: onecorecommonproxystub.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: execmodelproxy.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: resourcepolicyclient.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: vssapi.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: vsstrace.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: samcli.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: samlib.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: es.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: bitsproxy.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc6.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: schannel.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: mskeyprotect.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: ntasn1.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: ncrypt.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: ncryptsslp.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: msasn1.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: rsaenh.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: dpapi.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: mpr.dll
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
                                  Source: Window RecorderWindow detected: More than 3 window changes detected
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: certificate valid
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic file information: File size 5620152 > 1048576
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x533200
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb source: ScreenConnect.WindowsFileManager.exe.2.dr
                                  Source: Binary string: e089\mscorlib.pdb source: ScreenConnect.ClientService.exe, 00000007.00000002.2956390262.00000000054B0000.00000004.00000020.00020000.00000000.sdmp
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientInstallerRunner\obj\Release\ScreenConnect.ClientInstallerRunner.pdb source: NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsInstaller\obj\Release\net20\ScreenConnect.WindowsInstaller.pdbM source: NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: Binary string: System.pdbN|2h|2 Z|2_CorDllMainmscoree.dll source: ScreenConnect.ClientService.exe, 00000007.00000002.2956390262.00000000054F7000.00000004.00000020.00020000.00000000.sdmp
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsInstaller\obj\Release\net20\ScreenConnect.WindowsInstaller.pdb source: NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdbT source: Microsoft.Deployment.WindowsInstaller.dll.4.dr
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.2.dr
                                  Source: Binary string: \??\C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Client.PDB source: ScreenConnect.ClientService.exe, 00000007.00000002.2931238888.00000000013B7000.00000004.00000020.00020000.00000000.sdmp
                                  Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller.Package\Microsoft.Deployment.WindowsInstaller.Package.pdb source: Microsoft.Deployment.WindowsInstaller.Package.dll.4.dr
                                  Source: Binary string: C:\Compile\screenconnect\Product\WindowsAuthenticationPackage\bin\Release\ScreenConnect.WindowsAuthenticationPackage.pdb source: ScreenConnect.ClientService.exe, 00000007.00000002.2949999548.0000000003067000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.2945675574.0000000012D00000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.2.dr
                                  Source: Binary string: System.pdb source: ScreenConnect.ClientService.exe, 00000007.00000002.2956390262.00000000054F7000.00000004.00000020.00020000.00000000.sdmp
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: NotaFiscalOnline.ClientSetup.ex#.exe, ScreenConnect.Core.dll.4.dr, ScreenConnect.Core.dll.2.dr
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: ScreenConnect.WindowsClient.exe, 00000008.00000002.2933702877.0000000001302000.00000002.00000001.01000000.0000000D.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.2933117951.0000000001260000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.2935287983.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.dll.2.dr
                                  Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\DotNetResolver\obj\Debug\DotNetResolver.pdb source: NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 00000007.00000000.1723067436.000000000058D000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.ClientService.exe.2.dr
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: NotaFiscalOnline.ClientSetup.ex#.exe, ScreenConnect.Windows.dll.2.dr
                                  Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\Compression.Cab\Microsoft.Deployment.Compression.Cab.pdb source: rundll32.exe, 00000004.00000003.1699620917.0000000004A35000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1708448418.00000000048C0000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.Cab.dll.4.dr
                                  Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdb source: Microsoft.Deployment.WindowsInstaller.dll.4.dr
                                  Source: Binary string: \??\C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Core.pdb source: ScreenConnect.ClientService.exe, 00000007.00000002.2931238888.00000000013B7000.00000004.00000020.00020000.00000000.sdmp
                                  Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: ScreenConnect.ClientService.exe, 00000007.00000002.2931238888.00000000013B7000.00000004.00000020.00020000.00000000.sdmp
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\InstallerActions\obj\Release\net20\ScreenConnect.InstallerActions.pdb source: ScreenConnect.InstallerActions.dll.4.dr
                                  Source: Binary string: C:\build\work\eca3d12b\wix3\build\ship\x86\wixca.pdb source: NotaFiscalOnline.ClientSetup.ex#.exe, MSI2FC1.tmp.2.dr, MSI2D9C.tmp.2.dr, MSI2DDC.tmp.2.dr, 652b3d.msi.2.dr, 652b3c.rbs.2.dr, ScreenConnect.ClientSetup.msi.0.dr, 652b3b.msi.2.dr
                                  Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\Compression\Microsoft.Deployment.Compression.pdb source: rundll32.exe, 00000004.00000003.1699620917.00000000049C6000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.dll.4.dr
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdbS] source: NotaFiscalOnline.ClientSetup.ex#.exe, ScreenConnect.Windows.dll.2.dr
                                  Source: Binary string: screenconnect_windows_credential_provider.pdb source: ScreenConnect.ClientService.exe, 00000007.00000002.2949999548.0000000003067000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.2945675574.0000000012D00000.00000004.00000800.00020000.00000000.sdmp
                                  Source: Binary string: \??\C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Client.pdb source: ScreenConnect.ClientService.exe, 00000007.00000002.2931238888.00000000013B7000.00000004.00000020.00020000.00000000.sdmp
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000008.00000000.1742944760.0000000000952000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.WindowsClient.exe.2.dr
                                  Source: Binary string: E:\delivery\Dev\wix37_public\build\ship\x86\SfxCA.pdb source: NotaFiscalOnline.ClientSetup.ex#.exe, 652b3d.msi.2.dr, ScreenConnect.ClientSetup.msi.0.dr, 652b3b.msi.2.dr, MSI2520.tmp.1.dr
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdbi source: ScreenConnect.ClientService.exe, 00000007.00000002.2956390262.00000000054F7000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.2933268506.0000000001282000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Client.dll.2.dr
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdbu source: ScreenConnect.WindowsClient.exe, 00000008.00000000.1742944760.0000000000952000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.WindowsClient.exe.2.dr
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: ScreenConnect.ClientService.exe, 00000007.00000002.2956390262.00000000054F7000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.2933268506.0000000001282000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Client.dll.2.dr
                                  Source: Binary string: screenconnect_windows_credential_provider.pdb' source: ScreenConnect.ClientService.exe, 00000007.00000002.2949999548.0000000003067000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.2945675574.0000000012D00000.00000004.00000800.00020000.00000000.sdmp
                                  Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetRunner.pdb source: NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbd source: ScreenConnect.ClientService.exe, 00000007.00000002.2931238888.00000000013B7000.00000004.00000020.00020000.00000000.sdmp
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: real checksum: 0x54d1c1 should be: 0x5623c4
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeCode function: 0_2_05B06460 pushfd ; retf 0_2_05B06461
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeCode function: 0_2_05B03AD7 push ebx; retf 0_2_05B03ADA
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeCode function: 0_2_05B23A99 push ebx; retf 0_2_05B23ADA
                                  Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_3_06F08462 push es; ret 4_3_06F08470
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_045FCDA8 push ebx; retf 0004h7_2_045FCDD2
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_045FCF7F pushad ; retf 0004h7_2_045FCF92
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_045FF16F pushfd ; retf 0004h7_2_045FF189
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_045F3A9B push ebx; retf 7_2_045F3ADA
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_0572E430 push eax; mov dword ptr [esp], ecx7_2_0572E431
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_0572C1D0 push eax; mov dword ptr [esp], ecx7_2_0572C1D1
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_0572C1C1 push eax; mov dword ptr [esp], ecx7_2_0572C1D1
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_05725B60 push eax; mov dword ptr [esp], ecx7_2_05725B71
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_06020F81 pushad ; ret 7_2_06020F93
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FFD9B4122B1 push ebx; retf 8_2_00007FFD9B4122FA
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FFD9B4109D8 push ebx; retf 8_2_00007FFD9B41098A
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FFD9B41222E push ebx; retf 8_2_00007FFD9B4122FA
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FFD9B4108CD push ebx; retf 8_2_00007FFD9B41098A
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FFD9B71D9C2 push eax; iretd 8_2_00007FFD9B71DB9D
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FFD9B71DBE6 push eax; iretd 8_2_00007FFD9B71DBF5
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FFD9B71DC00 push edi; retf 8_2_00007FFD9B71DC02
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FFD9B71DBA0 push eax; iretd 8_2_00007FFD9B71DB9D
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FFD9B718EF8 pushad ; retn 5EF6h8_2_00007FFD9B71919D
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FFD9B712F5A pushfd ; iretd 8_2_00007FFD9B712F5B
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FFD9B71DA6B push eax; iretd 8_2_00007FFD9B71DB9D

                                  Persistence and Installation Behavior

                                  barindex
                                  Possible COM Object hijacking
                                  Source: c:\program files (x86)\screenconnect client (bc180d8c7278c2c2)\screenconnect.windowscredentialprovider.dllCOM Object registered for dropped file: hkey_local_machine\software\classes\clsid\{6ff59a85-bc37-4cd4-9733-9712fc2d2a8b}\inprocserver32
                                  Source: C:\Windows\SysWOW64\msiexec.exeFile created: C:\Users\user\AppData\Local\Temp\MSI2520.tmpJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Client.dllJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsAuthenticationPackage.dllJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeJump to dropped file
                                  Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSI2520.tmp-\Microsoft.Deployment.WindowsInstaller.dllJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI2DDC.tmpJump to dropped file
                                  Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSI2520.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dllJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsFileManager.exeJump to dropped file
                                  Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSI2520.tmp-\ScreenConnect.InstallerActions.dllJump to dropped file
                                  Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSI2520.tmp-\Microsoft.Deployment.Compression.Cab.dllJump to dropped file
                                  Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSI2520.tmp-\ScreenConnect.Windows.dllJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsBackstageShell.exeJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Windows.dllJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI2FC1.tmpJump to dropped file
                                  Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSI2520.tmp-\ScreenConnect.Core.dllJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.dllJump to dropped file
                                  Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSI2520.tmp-\Microsoft.Deployment.Compression.dllJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsCredentialProvider.dllJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Core.dllJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI2DDC.tmpJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI2FC1.tmpJump to dropped file
                                  Source: ScreenConnect.ClientService.dll.2.drBinary or memory string: bcdedit.exeg/copy {current} /d "Reboot and Reconnect Safe Mode"7{.{8}-.{4}-.{4}-.{4}-.{12}}
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NotaFiscalOnline.ClientSetup.ex#.exe.logJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeRegistry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\ApplicationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeRegistry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (bc180d8c7278c2c2)Jump to behavior

                                  Hooking and other Techniques for Hiding and Protection

                                  barindex
                                  Contains functionality to hide user accounts
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000002.1718685571.0000000005940000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000000.1682451497.0000000000326000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                                  Source: rundll32.exe, 00000004.00000003.1699620917.0000000004A41000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.2933702877.0000000001302000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.2933117951.0000000001260000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.2935287983.0000000002CF1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.2949981215.000000001BA72000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                                  Source: ScreenConnect.ClientService.dll.2.drString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
                                  Source: ScreenConnect.Windows.dll.2.drString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeMemory allocated: 17C0000 memory reserve | memory write watchJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeMemory allocated: 3230000 memory reserve | memory write watchJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeMemory allocated: 17C0000 memory reserve | memory write watchJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeMemory allocated: 6A90000 memory reserve | memory write watchJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeMemory allocated: 6170000 memory reserve | memory write watchJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeMemory allocated: 1850000 memory reserve | memory write watchJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeMemory allocated: 2060000 memory reserve | memory write watchJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeMemory allocated: 1EB0000 memory reserve | memory write watchJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeMemory allocated: F10000 memory reserve | memory write watchJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeMemory allocated: 1ACF0000 memory reserve | memory write watchJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeThread delayed: delay time: 922337203685477Jump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI2520.tmpJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Client.dllJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsAuthenticationPackage.dllJump to dropped file
                                  Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI2520.tmp-\Microsoft.Deployment.WindowsInstaller.dllJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Installer\MSI2DDC.tmpJump to dropped file
                                  Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI2520.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dllJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsFileManager.exeJump to dropped file
                                  Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI2520.tmp-\ScreenConnect.InstallerActions.dllJump to dropped file
                                  Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI2520.tmp-\Microsoft.Deployment.Compression.Cab.dllJump to dropped file
                                  Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI2520.tmp-\ScreenConnect.Windows.dllJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsBackstageShell.exeJump to dropped file
                                  Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI2520.tmp-\ScreenConnect.Core.dllJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Windows.dllJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Installer\MSI2FC1.tmpJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.dllJump to dropped file
                                  Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI2520.tmp-\Microsoft.Deployment.Compression.dllJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsCredentialProvider.dllJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Core.dllJump to dropped file
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeAPI coverage: 2.1 %
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exe TID: 6512Thread sleep time: -922337203685477s >= -30000sJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe TID: 5300Thread sleep count: 34 > 30Jump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe TID: 1376Thread sleep time: -30000s >= -30000sJump to behavior
                                  Source: C:\Windows\System32\svchost.exe TID: 6516Thread sleep time: -30000s >= -30000s
                                  Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0
                                  Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeThread delayed: delay time: 922337203685477Jump to behavior
                                  Source: svchost.exe, 00000009.00000002.2934289317.000002AE91C54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                                  Source: svchost.exe, 00000009.00000002.2932064009.000002AE8C62B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW`l
                                  Source: ScreenConnect.ClientService.exe, 00000007.00000002.2956390262.00000000054B0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll`
                                  Source: C:\Windows\System32\msiexec.exeProcess information queried: ProcessInformationJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess token adjusted: DebugJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess token adjusted: DebugJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeMemory allocated: page read and write | page guardJump to behavior

                                  HIPS / PFW / Operating System Protection Evasion

                                  barindex
                                  .NET source code references suspicious native API functions
                                  Source: 0.2.NotaFiscalOnline.ClientSetup.ex#.exe.5740000.6.raw.unpack, NativeLibrary.csReference to suspicious API methods: LoadLibrary(type, assemblyTypeHint)
                                  Source: 0.2.NotaFiscalOnline.ClientSetup.ex#.exe.5940000.8.raw.unpack, WindowsMemoryNativeLibrary.csReference to suspicious API methods: WindowsNative.VirtualAlloc(attemptImageBase, dwSize, WindowsNative.MEM.MEM_COMMIT | WindowsNative.MEM.MEM_RESERVE, WindowsNative.PAGE.PAGE_READWRITE)
                                  Source: 0.2.NotaFiscalOnline.ClientSetup.ex#.exe.5940000.8.raw.unpack, WindowsMemoryNativeLibrary.csReference to suspicious API methods: WindowsNative.GetProcAddress(intPtr, ptr5)
                                  Source: 0.2.NotaFiscalOnline.ClientSetup.ex#.exe.5940000.8.raw.unpack, WindowsMemoryNativeLibrary.csReference to suspicious API methods: WindowsNative.VirtualProtect(loadedImageBase + sectionHeaders[i].VirtualAddress, (IntPtr)num, flNewProtect, &pAGE)
                                  Source: 0.2.NotaFiscalOnline.ClientSetup.ex#.exe.5940000.8.raw.unpack, WindowsExtensions.csReference to suspicious API methods: HandleMinder.CreateWithFunc(WindowsNative.OpenProcess(processAccess, bInheritHandle: false, processID), WindowsNative.CloseHandle)
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ScreenConnect\24.3.7.9067\bc180d8c7278c2c2\ScreenConnect.ClientSetup.msi"Jump to behavior
                                  Source: unknownProcess created: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe "c:\program files (x86)\screenconnect client (bc180d8c7278c2c2)\screenconnect.clientservice.exe" "?e=access&y=guest&h=instance-moi41i-relay.screenconnect.com&p=443&s=c0ccf19a-72f4-49f1-916b-7723f411f3c8&k=bgiaaackaabsu0exaagaaaeaaqctuxkvr37hxsnskxbtvhrtqfy7qjemo6ocjc91wfovr4mubl0kg%2fpw0y6o4cbp7p%2bpwddglrq%2fnegwh7s00d6wq1mfdbfm9uj%2f4fypfz638le3ocnk3gxv9nheoz1ff8a9u5e0j2aodxpea5zamczc%2b7qzoofcfawbpymeq6yylchlnp1mxk8ywdx7euaaem9de2i95sghgzovvq0fnyxolqyif5ehmgy9z1lvbviexeswvl3znzwao%2f2y0tpixgxuugxl5lrto6is%2bwkhhkczwcy3hm8zx1l10%2fafghe8wmajedg1ddskstcut%2fycxprx7msqdutkmhfpmz4no3hw"
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000000.1742944760.0000000000952000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.WindowsClient.exe.2.drBinary or memory string: Progman
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000000.1742944760.0000000000952000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.WindowsClient.exe.2.drBinary or memory string: Shell_TrayWnd-Shell_SecondaryTrayWnd%MsgrIMEWindowClass
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Users\user\AppData\Local\Temp\MSI2520.tmp-\Microsoft.Deployment.WindowsInstaller.dll VolumeInformationJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Users\user\AppData\Local\Temp\MSI2520.tmp-\ScreenConnect.InstallerActions.dll VolumeInformationJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Users\user\AppData\Local\Temp\MSI2520.tmp-\ScreenConnect.Core.dll VolumeInformationJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Users\user\AppData\Local\Temp\MSI2520.tmp-\ScreenConnect.Windows.dll VolumeInformationJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.dll VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.dll VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Core.dll VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Windows.dll VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Client.dll VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exe VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Client.dll VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Core.dll VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Windows.dll VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.dll VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformationJump to behavior
                                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
                                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
                                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
                                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
                                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
                                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_0572CF2C CreateNamedPipeW,7_2_0572CF2C
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeCode function: 0_2_05B02D07 RtlGetVersion,0_2_05B02D07
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                                  Lowering of HIPS / PFW / Operating System Security Settings

                                  barindex
                                  Modifies security policies related information
                                  Source: C:\Windows\System32\msiexec.exeRegistry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa Authentication PackagesJump to behavior
                                  Source: Yara matchFile source: NotaFiscalOnline.ClientSetup.ex#.exe, type: SAMPLE
                                  Source: Yara matchFile source: 8.0.ScreenConnect.WindowsClient.exe.950000.0.unpack, type: UNPACKEDPE
                                  Source: Yara matchFile source: 0.2.NotaFiscalOnline.ClientSetup.ex#.exe.5c40000.13.raw.unpack, type: UNPACKEDPE
                                  Source: Yara matchFile source: 8.2.ScreenConnect.WindowsClient.exe.2d6fa10.5.raw.unpack, type: UNPACKEDPE
                                  Source: Yara matchFile source: 0.2.NotaFiscalOnline.ClientSetup.ex#.exe.5c40000.13.unpack, type: UNPACKEDPE
                                  Source: Yara matchFile source: 0.0.NotaFiscalOnline.ClientSetup.ex#.exe.3ac3d4.1.raw.unpack, type: UNPACKEDPE
                                  Source: Yara matchFile source: 0.0.NotaFiscalOnline.ClientSetup.ex#.exe.3263d4.4.raw.unpack, type: UNPACKEDPE
                                  Source: Yara matchFile source: 0.0.NotaFiscalOnline.ClientSetup.ex#.exe.3d5db0.3.raw.unpack, type: UNPACKEDPE
                                  Source: Yara matchFile source: 0.0.NotaFiscalOnline.ClientSetup.ex#.exe.310000.0.unpack, type: UNPACKEDPE
                                  Source: Yara matchFile source: 00000000.00000002.1720978268.0000000005C40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                                  Source: Yara matchFile source: 00000008.00000000.1742944760.0000000000952000.00000002.00000001.01000000.00000011.sdmp, type: MEMORY
                                  Source: Yara matchFile source: 00000008.00000002.2935287983.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                                  Source: Yara matchFile source: 00000000.00000000.1682451497.0000000000326000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                                  Source: Yara matchFile source: Process Memory Space: NotaFiscalOnline.ClientSetup.ex#.exe PID: 6448, type: MEMORYSTR
                                  Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 7040, type: MEMORYSTR
                                  Source: Yara matchFile source: Process Memory Space: ScreenConnect.WindowsClient.exe PID: 7104, type: MEMORYSTR
                                  Source: Yara matchFile source: C:\Windows\Temp\~DF31A1C5F44E3BDC22.TMP, type: DROPPED
                                  Source: Yara matchFile source: C:\Windows\Temp\~DF3ACDD70DD54C3FFA.TMP, type: DROPPED
                                  Source: Yara matchFile source: C:\Windows\Installer\inprogressinstallinfo.ipi, type: DROPPED
                                  Source: Yara matchFile source: C:\Config.Msi\652b3c.rbs, type: DROPPED
                                  Source: Yara matchFile source: C:\Windows\Temp\~DFDC109B3E936D4CFB.TMP, type: DROPPED
                                  Source: Yara matchFile source: C:\Windows\Temp\~DF5429B9B17B4B71FC.TMP, type: DROPPED
                                  Source: Yara matchFile source: C:\Windows\Temp\~DF2D5C6F810C43607F.TMP, type: DROPPED
                                  Source: Yara matchFile source: C:\Windows\Installer\MSI2D9C.tmp, type: DROPPED
                                  Source: Yara matchFile source: C:\Windows\Temp\~DF128E7F83555EDFF9.TMP, type: DROPPED
                                  Source: Yara matchFile source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exe, type: DROPPED

                                  Mitre Att&ck Matrix

                                  ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                                  Gather Victim Identity InformationAcquire Infrastructure1
                                  Valid Accounts                                  		1
                                  Native API                                  		1
                                  DLL Side-Loading                                  		1
                                  DLL Side-Loading                                  		11
                                  Disable or Modify Tools                                  		OS Credential Dumping11
                                  Peripheral Device Discovery                                  		Remote Services11
                                  Archive Collected Data                                  		22
                                  Encrypted Channel                                  		Exfiltration Over Other Network MediumAbuse Accessibility Features
                                  CredentialsDomains1
                                  Replication Through Removable Media                                  		12
                                  Command and Scripting Interpreter                                  		1
                                  DLL Search Order Hijacking                                  		1
                                  DLL Search Order Hijacking                                  		1
                                  Deobfuscate/Decode Files or Information                                  		LSASS Memory1
                                  File and Directory Discovery                                  		Remote Desktop ProtocolData from Removable Media1
                                  Non-Application Layer Protocol                                  		Exfiltration Over BluetoothNetwork Denial of Service
                                  Email AddressesDNS ServerDomain AccountsAt1
                                  Component Object Model Hijacking                                  		1
                                  Component Object Model Hijacking                                  		1
                                  Obfuscated Files or Information                                  		Security Account Manager24
                                  System Information Discovery                                  		SMB/Windows Admin SharesData from Network Shared Drive2
                                  Application Layer Protocol                                  		Automated ExfiltrationData Encrypted for Impact
                                  Employee NamesVirtual Private ServerLocal AccountsCron1
                                  Valid Accounts                                  		1
                                  Valid Accounts                                  		1
                                  DLL Side-Loading                                  		NTDS11
                                  Security Software Discovery                                  		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
                                  Gather Victim Network InformationServerCloud AccountsLaunchd2
                                  Windows Service                                  		1
                                  Access Token Manipulation                                  		1
                                  DLL Search Order Hijacking                                  		LSA Secrets2
                                  Process Discovery                                  		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                                  Domain PropertiesBotnetReplication Through Removable MediaScheduled Task1
                                  Bootkit                                  		2
                                  Windows Service                                  		1
                                  File Deletion                                  		Cached Domain Credentials41
                                  Virtualization/Sandbox Evasion                                  		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                                  DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup Items13
                                  Process Injection                                  		22
                                  Masquerading                                  		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                                  Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
                                  Valid Accounts                                  		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                                  Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
                                  Access Token Manipulation                                  		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                                  IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron41
                                  Virtualization/Sandbox Evasion                                  		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
                                  Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd13
                                  Process Injection                                  		Input CaptureSystem Network Connections DiscoverySoftware Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption
                                  Gather Victim Org InformationDNS ServerCompromise Software Supply ChainWindows Command ShellScheduled TaskScheduled Task1
                                  Hidden Users                                  		KeyloggingProcess DiscoveryTaint Shared ContentScreen CaptureDNSExfiltration Over Physical MediumResource Hijacking
                                  Determine Physical LocationsVirtual Private ServerCompromise Hardware Supply ChainUnix ShellSystemd TimersSystemd Timers1
                                  Bootkit                                  		GUI Input CapturePermission Groups DiscoveryReplication Through Removable MediaEmail CollectionProxyExfiltration over USBNetwork Denial of Service
                                  Business RelationshipsServerTrusted RelationshipVisual BasicContainer Orchestration JobContainer Orchestration Job1
                                  Rundll32                                  		Web Portal CaptureLocal GroupsComponent Object Model and Distributed COMLocal Email CollectionInternal ProxyCommonly Used PortDirect Network Flood

                                  Behavior Graph

                                  Hide Legend

                                  Legend:

                                  • Process
                                  • Signature
                                  • Created File
                                  • DNS/IP Info
                                  • Is Dropped
                                  • Is Windows Process
                                  • Number of created Registry Values
                                  • Number of created Files
                                  • Visual Basic
                                  • Delphi
                                  • Java
                                  • .Net C# or VB.NET
                                  • C, C++ or other language
                                  • Is malicious
                                  • Internet
                                  behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1579141 Sample: NotaFiscalOnline.ClientSetu... Startdate: 20/12/2024 Architecture: WINDOWS Score: 63 55 server-ovh31444376-relay.screenconnect.com 2->55 57 instance-moi41i-relay.screenconnect.com 2->57 65 Multi AV Scanner detection for submitted file 2->65 67 .NET source code references suspicious native API functions 2->67 69 Detected potential unwanted application 2->69 71 3 other signatures 2->71 8 msiexec.exe 93 48 2->8         started        12 ScreenConnect.ClientService.exe 17 21 2->12         started        15 NotaFiscalOnline.ClientSetup.ex#.exe 6 2->15         started        17 svchost.exe 2->17         started        signatures3 process4 dnsIp5 35 ScreenConnect.Wind...dentialProvider.dll, PE32+ 8->35 dropped 37 C:\...\ScreenConnect.ClientService.exe, PE32 8->37 dropped 39 C:\Windows\Installer\MSI2FC1.tmp, PE32 8->39 dropped 43 9 other files (none is malicious) 8->43 dropped 73 Enables network access during safeboot for specific services 8->73 75 Modifies security policies related information 8->75 19 msiexec.exe 8->19         started        21 msiexec.exe 1 8->21         started        23 msiexec.exe 8->23         started        59 server-ovh31444376-relay.screenconnect.com 51.89.135.228, 443, 49731, 49734 OVHFR France 12->59 77 Reads the Security eventlog 12->77 79 Reads the System eventlog 12->79 25 ScreenConnect.WindowsClient.exe 2 12->25         started        41 NotaFiscalOnline.ClientSetup.ex#.exe.log, ASCII 15->41 dropped 81 Contains functionality to hide user accounts 15->81 28 msiexec.exe 6 15->28         started        61 127.0.0.1 unknown unknown 17->61 file6 signatures7 process8 file9 31 rundll32.exe 11 19->31         started        83 Contains functionality to hide user accounts 25->83 45 C:\Users\user\AppData\Local\...\MSI2520.tmp, PE32 28->45 dropped signatures10 process11 file12 47 C:\Users\user\...\ScreenConnect.Windows.dll, PE32 31->47 dropped 49 C:\...\ScreenConnect.InstallerActions.dll, PE32 31->49 dropped 51 C:\Users\user\...\ScreenConnect.Core.dll, PE32 31->51 dropped 53 4 other files (none is malicious) 31->53 dropped 63 Contains functionality to hide user accounts 31->63 signatures13

                                  Screenshots

                                  Thumbnails

                                  This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                                  windows-stand

                                  Antivirus, Machine Learning and Genetic Malware Detection

                                  Initial Sample

                                  SourceDetectionScannerLabelLink
                                  NotaFiscalOnline.ClientSetup.ex#.exe18%ReversingLabsWin32.PUA.ConnectWise

                                  Dropped Files

                                  SourceDetectionScannerLabelLink
                                  C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Client.dll0%ReversingLabs
                                  C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.dll0%ReversingLabs
                                  C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe0%ReversingLabs
                                  C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Core.dll0%ReversingLabs
                                  C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Windows.dll0%ReversingLabs
                                  C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsAuthenticationPackage.dll0%ReversingLabs
                                  C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsBackstageShell.exe0%ReversingLabs
                                  C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exe0%ReversingLabs
                                  C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsCredentialProvider.dll0%ReversingLabs
                                  C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsFileManager.exe0%ReversingLabs
                                  C:\Users\user\AppData\Local\Temp\MSI2520.tmp0%ReversingLabs
                                  C:\Users\user\AppData\Local\Temp\MSI2520.tmp-\Microsoft.Deployment.Compression.Cab.dll0%ReversingLabs
                                  C:\Users\user\AppData\Local\Temp\MSI2520.tmp-\Microsoft.Deployment.Compression.dll0%ReversingLabs
                                  C:\Users\user\AppData\Local\Temp\MSI2520.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll0%ReversingLabs
                                  C:\Users\user\AppData\Local\Temp\MSI2520.tmp-\Microsoft.Deployment.WindowsInstaller.dll0%ReversingLabs
                                  C:\Users\user\AppData\Local\Temp\MSI2520.tmp-\ScreenConnect.Core.dll0%ReversingLabs
                                  C:\Users\user\AppData\Local\Temp\MSI2520.tmp-\ScreenConnect.InstallerActions.dll0%ReversingLabs
                                  C:\Users\user\AppData\Local\Temp\MSI2520.tmp-\ScreenConnect.Windows.dll0%ReversingLabs
                                  C:\Windows\Installer\MSI2DDC.tmp0%ReversingLabs
                                  C:\Windows\Installer\MSI2FC1.tmp0%ReversingLabs

                                  Unpacked PE Files

                                  ⊘No Antivirus matches

                                  Domains

                                  ⊘No Antivirus matches

                                  URLs

                                  ⊘No Antivirus matches

                                  Domains and IPs

                                  Contacted Domains

                                  NameIPActiveMaliciousAntivirus DetectionReputation
                                  server-ovh31444376-relay.screenconnect.com
                                  		51.89.135.228
                                  		truefalse
                                    		unknown
                                    instance-moi41i-relay.screenconnect.com
                                    		unknown
                                    		unknownfalse
                                      		unknown

                                      URLs from Memory and Binaries

                                      NameSourceMaliciousAntivirus DetectionReputation
                                      http://instance-moi41i-relay.screenconnect.com:443/?ScreenConnect.ClientService.exe, 00000007.00000002.2931238888.000000000143C000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		unknown
                                        http://www.apache.org/licenses/LICENSE-2.0ScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		high
                                          http://www.fontbureau.comScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpfalse
                                            		high
                                            http://www.fontbureau.com/designersGScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpfalse
                                              		high
                                              http://www.fontbureau.com/designers/?ScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpfalse
                                                		high
                                                http://www.founder.com.cn/cn/bTheScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://www.fontbureau.com/designers?ScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://instance-moi41i-relay.screenconnect.com:443/ScreenConnect.ClientService.exe, 00000007.00000002.2931238888.000000000143C000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.2935236379.000000000237E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      		unknown
                                                      http://wixtoolset.org/Whttp://wixtoolset.org/telemetry/vrundll32.exe, 00000004.00000003.1699620917.00000000049C6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1699620917.0000000004A35000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1699856745.00000000048C3000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.4.dr, Microsoft.Deployment.Compression.dll.4.dr, Microsoft.Deployment.Compression.Cab.dll.4.drfalse
                                                        		high
                                                        https://docs.rs/getrandom#nodejs-es-module-supportScreenConnect.WindowsClient.exe, 00000008.00000002.2945675574.0000000012D00000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          		high
                                                          http://crl.ver)svchost.exe, 00000009.00000002.2934511786.000002AE91C85000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            http://instance-moi41i-relay.screenconnect.com:443/-ScreenConnect.ClientService.exe, 00000007.00000002.2931238888.000000000143C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		unknown
                                                              http://www.tiro.comScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://g.live.com/odclientsettings/ProdV2.C:edb.log.9.drfalse
                                                                  		high
                                                                  http://www.fontbureau.com/designersScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    http://wixtoolset.org/news/rundll32.exe, 00000004.00000003.1699620917.00000000049C6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1699620917.0000000004A35000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1699856745.00000000048C3000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.4.dr, Microsoft.Deployment.Compression.dll.4.dr, Microsoft.Deployment.Compression.Cab.dll.4.drfalse
                                                                      		high
                                                                      http://www.goodfont.co.krScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://instance-moi41i-relay.screenconnect.com:443/dScreenConnect.ClientService.exe, 00000007.00000002.2935236379.0000000002552000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.2935236379.0000000002237000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.2935236379.000000000237E000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.2935236379.000000000218E000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.2935236379.0000000002422000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.2935236379.00000000021BA000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.2935236379.0000000002525000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.2935236379.00000000022DD000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                          		unknown
                                                                          http://www.carterandcone.comlScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            http://www.sajatypeworks.comScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              http://www.typography.netDScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://g.live.com/odclientsettings/Prod.C:edb.log.9.drfalse
                                                                                  		high
                                                                                  http://www.fontbureau.com/designers/cabarga.htmlNScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    http://www.founder.com.cn/cn/cTheScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      http://www.galapagosdesign.com/staff/dennis.htmScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        http://wixtoolset.org/releases/rundll32.exe, 00000004.00000003.1699620917.00000000049C6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1699620917.0000000004A35000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1699856745.00000000048C3000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.4.dr, Microsoft.Deployment.Compression.dll.4.dr, Microsoft.Deployment.Compression.Cab.dll.4.drfalse
                                                                                          		high
                                                                                          http://www.founder.com.cn/cnScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            http://www.fontbureau.com/designers/frere-user.htmlScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://g.live.com/odclientsettings/ProdV2edb.log.9.drfalse
                                                                                                		high
                                                                                                http://instance-moi41i-relay.screenconnect.com:443/)TScreenConnect.ClientService.exe, 00000007.00000002.2931238888.000000000143C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		unknown
                                                                                                  https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96svchost.exe, 00000009.00000003.1759022264.000002AE91EC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.drfalse
                                                                                                    		high
                                                                                                    http://instance-moi41i-relay.screenconnect.com:443/sTScreenConnect.ClientService.exe, 00000007.00000002.2931238888.000000000143C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		unknown
                                                                                                      http://www.jiyu-kobo.co.jp/ScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://feedback.screenconnect.com/Feedback.axdScreenConnect.Core.dll.2.drfalse
                                                                                                          		high
                                                                                                          http://www.galapagosdesign.com/DPleaseScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            http://www.fontbureau.com/designers8ScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              http://www.fonts.comScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                http://www.sandoll.co.krScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  http://www.urwpp.deDPleaseScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    http://www.zhongyicts.com.cnScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameNotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000002.1694147938.0000000003231000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.2935236379.00000000020C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        http://www.sakkal.comScreenConnect.WindowsClient.exe, 00000008.00000002.2956385458.000000001D682000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6svchost.exe, 00000009.00000003.1759022264.000002AE91EC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.drfalse
                                                                                                                            		high

                                                                                                                            World Map of Contacted IPs

                                                                                                                            • No. of IPs < 25%
                                                                                                                            • 25% < No. of IPs < 50%
                                                                                                                            • 50% < No. of IPs < 75%
                                                                                                                            • 75% < No. of IPs

                                                                                                                            Public IPs

                                                                                                                            IPDomainCountryFlagASNASN NameMalicious
                                                                                                                            51.89.135.228
                                                                                                                            		server-ovh31444376-relay.screenconnect.comFrance
                                                                                                                            		16276OVHFRfalse

                                                                                                                            Private

                                                                                                                            IP
                                                                                                                            127.0.0.1

                                                                                                                            General Information

                                                                                                                            Joe Sandbox version:41.0.0 Charoite
                                                                                                                            Analysis ID:1579141
                                                                                                                            Start date and time:2024-12-20 22:32:08 +01:00
                                                                                                                            Joe Sandbox product:CloudBasic
                                                                                                                            Overall analysis duration:0h 8m 17s
                                                                                                                            Hypervisor based Inspection enabled:false
                                                                                                                            Report type:full
                                                                                                                            Cookbook file name:default.jbs
                                                                                                                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                            Number of analysed new started processes analysed:14
                                                                                                                            Number of new started drivers analysed:0
                                                                                                                            Number of existing processes analysed:0
                                                                                                                            Number of existing drivers analysed:0
                                                                                                                            Number of injected processes analysed:0
                                                                                                                            Technologies:
                                                                                                                            • HCA enabled
                                                                                                                            • EGA enabled
                                                                                                                            • AMSI enabled
                                                                                                                            Analysis Mode:default
                                                                                                                            Analysis stop reason:Timeout
                                                                                                                            Sample name:NotaFiscalOnline.ClientSetup.ex#.exe
                                                                                                                            Detection:MAL
                                                                                                                            Classification:mal63.evad.winEXE@16/64@3/2
                                                                                                                            EGA Information:
                                                                                                                            • Successful, ratio: 75%
                                                                                                                            HCA Information:
                                                                                                                            • Successful, ratio: 79%
                                                                                                                            • Number of executed functions: 240
                                                                                                                            • Number of non-executed functions: 1
                                                                                                                            Cookbook Comments:
                                                                                                                            • Found application associated with file extension: .exe

                                                                                                                            Warnings

                                                                                                                            • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                                                                                                                            • Excluded IPs from analysis (whitelisted): 184.28.90.27, 4.245.163.56, 13.107.246.63
                                                                                                                            • Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
                                                                                                                            • Execution Graph export aborted for target rundll32.exe, PID 7040 because it is empty
                                                                                                                            • Not all processes where analyzed, report is missing behavior information
                                                                                                                            • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                            • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                                                                            • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                                            • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                            • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                            • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                            • VT rate limit hit for: NotaFiscalOnline.ClientSetup.ex#.exe

                                                                                                                            Simulations

                                                                                                                            Behavior and APIs

                                                                                                                            TimeTypeDescription
                                                                                                                            16:33:09API Interceptor2x Sleep call for process: svchost.exe modified
                                                                                                                            16:33:16API Interceptor1x Sleep call for process: ScreenConnect.ClientService.exe modified

                                                                                                                            Joe Sandbox View / Context

                                                                                                                            IPs

                                                                                                                            ⊘No context

                                                                                                                            Domains

                                                                                                                            ⊘No context

                                                                                                                            ASNs

                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                            OVHFRla.bot.sparc.elfGet hashmaliciousMiraiBrowse
                                                                                                                            • 198.27.68.45
                                                                                                                            nshkmips.elfGet hashmaliciousMiraiBrowse
                                                                                                                            • 51.195.151.42
                                                                                                                            https://ho8d1o.s3.amazonaws.com/index.html?AWSAccessKeyId=AKIAWPPO57XS4BTHJAEO&Signature=h4n%2BY6bT0YHF44DbJkmJeHwDnn0%3D&Expires=1734860434#mandy.pullen@peterborough.gov.ukGet hashmaliciousFake CaptchaBrowse
                                                                                                                            • 37.59.203.111
                                                                                                                            https://p.placed.com/api/v2/sync/impression?partner=barkley&plaid=0063o000014sWgoAAE&version=1.0&payload_campaign_identifier=71700000100870630&payload_timestamp=5943094174221506287&payload_type=impression&redirect=http%3A%2F%2Fgoogle.com%2Famp%2Fs%2Fgoal.com.co%2Fwp%2FpaymentGet hashmaliciousHTMLPhisherBrowse
                                                                                                                            • 144.217.96.200
                                                                                                                            la.bot.arm.elfGet hashmaliciousMiraiBrowse
                                                                                                                            • 144.217.245.96
                                                                                                                            mipsel.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                            • 51.161.74.237
                                                                                                                            x86.elfGet hashmaliciousMirai, MoobotBrowse
                                                                                                                            • 91.121.98.217
                                                                                                                            mipsel.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                            • 164.133.159.185
                                                                                                                            mips.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                            • 51.161.242.64
                                                                                                                            R4qP4YM0QX.lnkGet hashmaliciousUnknownBrowse
                                                                                                                            • 139.99.188.124

                                                                                                                            JA3 Fingerprints

                                                                                                                            ⊘No context

                                                                                                                            Dropped Files

                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                            C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Client.dllfile.exeGet hashmaliciousScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, VidarBrowse
                                                                                                                              file.exeGet hashmaliciousScreenConnect Tool, Amadey, RHADAMANTHYS, XWorm, XmrigBrowse
                                                                                                                                file.exeGet hashmaliciousScreenConnect Tool, Amadey, LummaC Stealer, Vidar, XWorm, XmrigBrowse
                                                                                                                                  dMDImIGmc7.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                                    dMDImIGmc7.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                                      estatement020134230003.exe.virus.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                                        estatement020134230003.exe.virus.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                                          Support.ClientSetup.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                                            f53WqfzzNt.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                                              tiG6Ep202n.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                                                C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.dllfile.exeGet hashmaliciousScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, VidarBrowse
                                                                                                                                                  file.exeGet hashmaliciousScreenConnect Tool, Amadey, RHADAMANTHYS, XWorm, XmrigBrowse
                                                                                                                                                    file.exeGet hashmaliciousScreenConnect Tool, Amadey, LummaC Stealer, Vidar, XWorm, XmrigBrowse
                                                                                                                                                      dMDImIGmc7.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                                                        dMDImIGmc7.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                                                          estatement020134230003.exe.virus.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                                                            estatement020134230003.exe.virus.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                                                              Support.ClientSetup.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                                                                f53WqfzzNt.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                                                                  tiG6Ep202n.exeGet hashmaliciousScreenConnect ToolBrowse

                                                                                                                                                                    Created / dropped Files

                                                                                                                                                                    C:\Config.Msi\652b3c.rbs

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:modified
                                                                                                                                                                    Size (bytes):219459
                                                                                                                                                                    Entropy (8bit):6.583173134313152
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3072:QN9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGW:QNuH2aCGw1ST1wQLdqvW
                                                                                                                                                                    MD5:1BABDAC6AE2C54E1F8DAF2178E14D54C
                                                                                                                                                                    SHA1:635793FF6CF8ECAC59A56F89F34958E2A56E3C7B
                                                                                                                                                                    SHA-256:33166D189B847EB7454BA9DC71B9D8A3742C8B1D214985606F1ECF6CB111076D
                                                                                                                                                                    SHA-512:D5D55D5DF6A812E66C7823D44FA6B56F3DE073679FE0D3378A8CD8EC3E44BF1FDB72935F3521521C323F61E759D556C8BD1DABCF700E4B941D9499A75C2FB49D
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Yara Hits:
                                                                                                                                                                    • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Config.Msi\652b3c.rbs, Author: Joe Security
                                                                                                                                                                    Reputation:low
                                                                                                                                                                    Preview:...@IXOS.@.....@#..Y.@.....@.....@.....@.....@.....@......&.{8ED2474F-3FEA-BB0F-7BE5-1BCA7E4AB8D2}'.ScreenConnect Client (bc180d8c7278c2c2)..ScreenConnect.ClientSetup.msi.@.....@.....@.....@......DefaultIcon..&.{8ED2474F-3FEA-BB0F-7BE5-1BCA7E4AB8D2}.....@.....@.....@.....@.......@.....@.....@.......@....'.ScreenConnect Client (bc180d8c7278c2c2)......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{85E972A2-ADDC-AEC6-9B6B-C4279751AB13}&.{8ED2474F-3FEA-BB0F-7BE5-1BCA7E4AB8D2}.@......&.{5B8C03F1-BFD0-62EB-2AB5-F8435CB476AD}&.{8ED2474F-3FEA-BB0F-7BE5-1BCA7E4AB8D2}.@......&.{5E913D78-93D2-DBC0-0EFD-192C823FC83F}&.{8ED2474F-3FEA-BB0F-7BE5-1BCA7E4AB8D2}.@......&.{995BECE1-4834-9DF8-019C-6C6D8B4E7B7D}&.{8ED2474F-3FEA-BB0F-7BE5-1BCA7E4AB8D2}.@......&.{F1A38D30-BE35-452F-17CC-A98D5A2F5C83}&.{8ED2474F-3FEA-BB0F-7BE5-1BCA7E4AB8D2}.@......&.{B1ADF76F-7552-64FA-581A-CB09465DCE5D}&.{8ED2474F-3FEA-BB0F-7BE5

                                                                                                                                                                    C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\Client.en-US.resources

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):50133
                                                                                                                                                                    Entropy (8bit):4.759054454534641
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:1536:p1+F+UTQd/3EUDv8vw+Dsj2jr0FJK97w/Leh/KR1exJKekmrg9:p1+F+UTQWUDv8vw+Dsj2jr0FJK97w/LR
                                                                                                                                                                    MD5:D524E8E6FD04B097F0401B2B668DB303
                                                                                                                                                                    SHA1:9486F89CE4968E03F6DCD082AA2E4C05AEF46FCC
                                                                                                                                                                    SHA-256:07D04E6D5376FFC8D81AFE8132E0AA6529CCCC5EE789BEA53D56C1A2DA062BE4
                                                                                                                                                                    SHA-512:E5BC6B876AFFEB252B198FEB8D213359ED3247E32C1F4BFC2C5419085CF74FE7571A51CAD4EAAAB8A44F1421F7CA87AF97C9B054BDB83F5A28FA9A880D4EFDE5
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:...........lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.q...'..6....wp.......y....C|.)>..Ldt..... $...X..........1$.../...2.%%3./>>...L.y.0.C._.........1Y..Qj.o....<....=...R..;...C....&.......1p2.r.x.u?Y..R...c......X.....I.5.2q..R...>.E.pw .@ ).w.l.....S...X..'.C.I......-.Y........4.J..P<.E..=c!.@To..#.._.2.....K.!..h...z......t......^..4...D...f..Q...:..%.z.<......^.....;<...r..yC.....Q........4_.Sns..z.......=..]t...X..<....8.e`}..n....S.H[..S@?.~....,...j.2..*v.......B....A...a......D..c..w..K,..t...S.....*v....7.6|..&.....r....#....G......Y...i..'.............'.......Z.....#2e..........|....)..%....A.....4{..u;N......&q...}.tD..x.....4...J...L......5.Q..M....K..3U..M..............5...........t.>.......lYu....3TY.?...r...'.......3.m........=.H...#.o.........n.....,4.~...<h..u...i.H...V......V/...P.$%..z...

                                                                                                                                                                    C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\Client.resources

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):26722
                                                                                                                                                                    Entropy (8bit):7.7401940386372345
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:384:rAClIRkKxFCQPZhNAmutHcRIfvVf6yMt+FRVoSVCdcDk6jO0n/uTYUq5ZplYKlBy:MV3PZrXgTf6vEVm6zjpGYUElerG49
                                                                                                                                                                    MD5:5CD580B22DA0C33EC6730B10A6C74932
                                                                                                                                                                    SHA1:0B6BDED7936178D80841B289769C6FF0C8EEAD2D
                                                                                                                                                                    SHA-256:DE185EE5D433E6CFBB2E5FCC903DBD60CC833A3CA5299F2862B253A41E7AA08C
                                                                                                                                                                    SHA-512:C2494533B26128FBF8149F7D20257D78D258ABFFB30E4E595CB9C6A742F00F1BF31B1EE202D4184661B98793B9909038CF03C04B563CE4ECA1E2EE2DEC3BF787
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:...........lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP)...s^.J.....E.....(....jF.C...1P)...H..../..72J..I.J.a.K8c._.ks`.k.`.kK..m.M6p............b...P...........'...!...............K...............w.......P.......1......."A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.1.6.....$A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.2.5.6....."A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.3.2....."A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.4.8.....,A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.B.l.a.n.k.1.6.;...(A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.M.a.c.2.2.....0A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.O.p.a.q.u.e.1.9.2.8...,A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.T.i.t.l.e.1.6.....6B.l.a.n.k.M.o.n.i.t.o.r.B.a.c.k.g.r.o.u.n.d.C.o.l.o.r.4...6B.l.a.n.k.M.o.n.i.t.o.r.B.a.c.k.g.r.o.u.n.d.I.m.a.g.e.:...DB.l.a.n.k.M.o.n.i.t.o.r.B.a.c.k.g.r.o.u.n.d.I.m.a.g.e.V.i.s.i.b.l.e.xb..*B.l.a.n.k.M.o.n.i.t.o.r.T.e.x.t.C.o.l.o.r..b..*D.a.r.k.T.h.e.m.e.B.a.r.B.a.s.e.C.o.l.o.r..b..<D.a.r.k.T.h.

                                                                                                                                                                    C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Client.dll

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):197120
                                                                                                                                                                    Entropy (8bit):6.586775768189165
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3072:/xLtNGTlIyS7/ObjusqVFJRJcyzvYqSmzDvJXYF:FtNGTGySabqPJYbqSmG
                                                                                                                                                                    MD5:3724F06F3422F4E42B41E23ACB39B152
                                                                                                                                                                    SHA1:1220987627782D3C3397D4ABF01AC3777999E01C
                                                                                                                                                                    SHA-256:EA0A545F40FF491D02172228C1A39AE68344C4340A6094486A47BE746952E64F
                                                                                                                                                                    SHA-512:509D9A32179A700AD76471B4CD094B8EB6D5D4AE7AD15B20FD76C482ED6D68F44693FC36BCB3999DA9346AE9E43375CD8FE02B61EDEABE4E78C4E2E44BF71D42
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Joe Sandbox View:
                                                                                                                                                                    • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                    • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                    • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                    • Filename: dMDImIGmc7.exe, Detection: malicious, Browse
                                                                                                                                                                    • Filename: dMDImIGmc7.exe, Detection: malicious, Browse
                                                                                                                                                                    • Filename: estatement020134230003.exe.virus.exe, Detection: malicious, Browse
                                                                                                                                                                    • Filename: estatement020134230003.exe.virus.exe, Detection: malicious, Browse
                                                                                                                                                                    • Filename: Support.ClientSetup.exe, Detection: malicious, Browse
                                                                                                                                                                    • Filename: f53WqfzzNt.exe, Detection: malicious, Browse
                                                                                                                                                                    • Filename: tiG6Ep202n.exe, Detection: malicious, Browse
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ... ....... .......................`......#.....@.................................A...O.... ..|....................@..........8............................................ ............... ..H............text........ ...................... ..`.rsrc...|.... ......................@..@.reloc.......@......................@..B................u.......H...........4............_...... .........................................(....*..(....*^.(...........%...}....*:.(......}....*:.(......}....*:.(......}....*..{....*:.(......}....*.0..A........(....s....%.~(...%-.&~'.....y...s....%.(...(...+(...+o"...o....*....0..s.......~#.....2. ....+...j..... ......... ...............%.r...p.%.r...p............%.&...($....5..............s%....=...*..0...........~*...%-.&~).....|...s&...%.*...(...+..~+...%-.&~).....}...s(...%.+...(...+.r9..

                                                                                                                                                                    C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.dll

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):68096
                                                                                                                                                                    Entropy (8bit):6.06942231395039
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:1536:+A0ZscQ5V6TsQqoSD6h6+39QFVIl1zJhb8gq:p0Zy3gUOQFVQzJq
                                                                                                                                                                    MD5:5DB908C12D6E768081BCED0E165E36F8
                                                                                                                                                                    SHA1:F2D3160F15CFD0989091249A61132A369E44DEA4
                                                                                                                                                                    SHA-256:FD5818DCDF5FC76316B8F7F96630EC66BB1CB5B5A8127CF300E5842F2C74FFCA
                                                                                                                                                                    SHA-512:8400486CADB7C07C08338D8876BC14083B6F7DE8A8237F4FE866F4659139ACC0B587EB89289D281106E5BAF70187B3B5E86502A2E340113258F03994D959328D
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Joe Sandbox View:
                                                                                                                                                                    • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                    • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                    • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                    • Filename: dMDImIGmc7.exe, Detection: malicious, Browse
                                                                                                                                                                    • Filename: dMDImIGmc7.exe, Detection: malicious, Browse
                                                                                                                                                                    • Filename: estatement020134230003.exe.virus.exe, Detection: malicious, Browse
                                                                                                                                                                    • Filename: estatement020134230003.exe.virus.exe, Detection: malicious, Browse
                                                                                                                                                                    • Filename: Support.ClientSetup.exe, Detection: malicious, Browse
                                                                                                                                                                    • Filename: f53WqfzzNt.exe, Detection: malicious, Browse
                                                                                                                                                                    • Filename: tiG6Ep202n.exe, Detection: malicious, Browse
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...nu............" ..0.............. ... ...@....... ..............................p.....@.................................e ..O....@.......................`..........8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................. ......H........n..@...................<.........................................(....*^.(...........%...}....*:.(......}....*:.(......}....*:.(......}....*.~,...%-.&~+.....i...s....%.,...(...+*vs....%.}P.........s....(....*....0...........s....}.....s....}...........}.......(&.....}.....(....&.()..........s....o.....()...~-...%-.&~+.....j...s....%.-...o ....s!...}.....s"...}.....s#...}...... .... 0u.........s....s=...}....... ..6........s....s=...}.....('...($............o%........

                                                                                                                                                                    C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):95512
                                                                                                                                                                    Entropy (8bit):6.504684691533346
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:1536:Eg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkggU0HMx790K:dhbNDxZGXfdHrX7rAc6myJkggU0HqB
                                                                                                                                                                    MD5:75B21D04C69128A7230A0998086B61AA
                                                                                                                                                                    SHA1:244BD68A722CFE41D1F515F5E40C3742BE2B3D1D
                                                                                                                                                                    SHA-256:F1B5C000794F046259121C63ED37F9EFF0CFE1258588ECA6FD85E16D3922767E
                                                                                                                                                                    SHA-512:8D51B2CD5F21C211EB8FEA4B69DC9F91DFFA7BB004D9780C701DE35EAC616E02CA30EF3882D73412F7EAB1211C5AA908338F3FA10FDF05B110F62B8ECD9D24C2
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(..qF.qF.qF....qF.....qF....qF.<.B.qF.<.E.qF.<.C.qF....qF.#..qF.qG..qF.2.O.qF.2...qF.2.D.qF.Rich.qF.........................PE..L.....wc...............!.............!............@.................................>)....@.................................p...x....`..P............L...)...p......`!..p............................ ..@............................................text...:........................... ..`.rdata...f.......h..................@..@.data........@.......,..............@....rsrc...P....`.......6..............@..@.reloc.......p.......<..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Core.dll

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):548864
                                                                                                                                                                    Entropy (8bit):6.034211651049746
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12288:xC2YKhQCNc6kVTplfWL/YTHUYCBdySISYz:HhE6O7WL/EC
                                                                                                                                                                    MD5:14E7489FFEBBB5A2EA500F796D881AD9
                                                                                                                                                                    SHA1:0323EE0E1FAA4AA0E33FB6C6147290AA71637EBD
                                                                                                                                                                    SHA-256:A2E9752DE49D18E885CBD61B29905983D44B4BC0379A244BFABDAA3188C01F0A
                                                                                                                                                                    SHA-512:2110113240B7D803D8271139E0A2439DBC86AE8719ECD8B132BBDA2520F22DC3F169598C8E966AC9C0A40E617219CB8FE8AAC674904F6A1AE92D4AC1E20627CD
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l............." ..0..X...........s... ........... ..............................].....@.................................as..O.......t............................r..8............................................ ............... ..H............text....W... ...X.................. ..`.rsrc...t............Z..............@..@.reloc...............^..............@..B.................s......H........C..,/..................Dr........................................{:...*..{;...*V.(<.....}:.....};...*...0..A........u~.......4.,/(=....{:....{:...o>...,.(?....{;....{;...o@...*.*.*. ... )UU.Z(=....{:...oA...X )UU.Z(?....{;...oB...X*...0..b........r...p......%..{:......%q.........-.&.+.......oC....%..{;......%q.........-.&.+.......oC....(D...*..{E...*..{F...*V.(<.....}E.....}F...*.0..A........u........4.,/(=....{E....{E...o>...,.(?....{F....{F...o@...*.*.*. F.b# )UU.

                                                                                                                                                                    C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Windows.dll

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1721856
                                                                                                                                                                    Entropy (8bit):6.639085961200334
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24576:dx5xeYkYFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:dx5xTkYJkGYYpT0+TFiH7efP
                                                                                                                                                                    MD5:9AD3964BA3AD24C42C567E47F88C82B2
                                                                                                                                                                    SHA1:6B4B581FC4E3ECB91B24EC601DAA0594106BCC5D
                                                                                                                                                                    SHA-256:84A09ED81AFC5FF9A17F81763C044C82A2D9E26F852DE528112153EE9AB041D0
                                                                                                                                                                    SHA-512:CE557A89C0FE6DE59046116C1E262A36BBC3D561A91E44DCDA022BEF72CB75742C8B01BEDCC5B9B999E07D8DE1F94C665DD85D277E981B27B6BFEBEAF9E58097
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...y............." ..0..>..........~]... ...`....... ..............................8.....@.................................+]..O....`..|............................\..8............................................ ............... ..H............text....=... ...>.................. ..`.rsrc...|....`.......@..............@..@.reloc...............D..............@..B................_]......H.......t...d..............0....\........................................()...*^.()..........%...}....*:.().....}....*:.().....}....*:.().....}....*..s*...*..s+...*:.(,.....(-...*..{....*"..}....*J.(/........(0...&*:.(,.....(1...*..{2...*"..}2...*.0..(........(3......+.............(0...&..X....i2.*v.(,....s4...}.....s5...}....*v.{.....r...p(...+.....o7....*.0...........o8....+..o9......(...+&.o....-....,..o......*..........."........{..........o:...&.......(.....*....0..L...

                                                                                                                                                                    C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsAuthenticationPackage.dll

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):260168
                                                                                                                                                                    Entropy (8bit):6.416438906122177
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
                                                                                                                                                                    MD5:5ADCB5AE1A1690BE69FD22BDF3C2DB60
                                                                                                                                                                    SHA1:09A802B06A4387B0F13BF2CDA84F53CA5BDC3785
                                                                                                                                                                    SHA-256:A5B8F0070201E4F26260AF6A25941EA38BD7042AEFD48CD68B9ACF951FA99EE5
                                                                                                                                                                    SHA-512:812BE742F26D0C42FDDE20AB4A02F1B47389F8D1ACAA6A5BB3409BA27C64BE444AC06D4129981B48FA02D4C06B526CB5006219541B0786F8F37CF2A183A18A73
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A........................T....................V.......V.......V......................=U......=U......=U$.....=U......Rich....................PE..d.....Qf.........." ...'.^...^.......................................................(....`..........................................e.......f..P................ ......HP..........P%..p............................$..@............p...............................text...t].......^.................. ..`.rdata.......p.......b..............@..@.data....+...........d..............@....pdata... ......."...x..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................

                                                                                                                                                                    C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsBackstageShell.exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):61208
                                                                                                                                                                    Entropy (8bit):6.310126082367387
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:1536:kW/+lo6MOc8IoiKWjrNv8DtyQ4RE+TC6WAhVbb57bP8:kLlo6dccldyQGWy5s
                                                                                                                                                                    MD5:AFA97CAF20F3608799E670E9D6253247
                                                                                                                                                                    SHA1:7E410FDE0CA1350AA68EF478E48274888688F8EE
                                                                                                                                                                    SHA-256:E25F32BA3FA32FD0DDD99EB65B26835E30829B5E4B58573690AA717E093A5D8F
                                                                                                                                                                    SHA-512:FE0B378651783EF4ADD3851E12291C82EDCCDE1DBD1FA0B76D7A2C2DCD181E013B9361BBDAE4DAE946C0D45FB4BF6F75DC027F217326893C906E47041E3039B0
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....c+..........."...0.................. ........@.. ....................... .......r....@.....................................O....... ................)..............8............................................ ............... ..H............text........ ...................... ..`.rsrc... ...........................@..@.reloc..............................@..B........................H........S......................x.........................................(....*^.(.......a...%...}....*:.(......}....*:.(......}....*:.(......}....*....0..........(....(....(....(....r...p(....o....(....r...p..~....(....(....r9..p..~....(....(.....g~).....(....rY..p.(....&(.....(....s....( ...s....(!...*...0...........(".....(#.....($....s....%.o%...%.o&...%.o'...%s!...o(...%~....o)...}......(....o*...o+....(,.....@...%..(.....o-....s....}.....{...........s/...o0....s....}..

                                                                                                                                                                    C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsBackstageShell.exe.config

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):266
                                                                                                                                                                    Entropy (8bit):4.842791478883622
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
                                                                                                                                                                    MD5:728175E20FFBCEB46760BB5E1112F38B
                                                                                                                                                                    SHA1:2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
                                                                                                                                                                    SHA-256:87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
                                                                                                                                                                    SHA-512:FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

                                                                                                                                                                    C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):602392
                                                                                                                                                                    Entropy (8bit):6.176232491934078
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6144:fybAk1FVMVTZL/4TvqpU0pSdRW3akod1sI5mgve8mZXuRFtSc4q2/R4IEyxuV5AN:qbAOwJ/MvIFptJoR5NmtiFsxsFE
                                                                                                                                                                    MD5:1778204A8C3BC2B8E5E4194EDBAF7135
                                                                                                                                                                    SHA1:0203B65E92D2D1200DD695FE4C334955BEFBDDD3
                                                                                                                                                                    SHA-256:600CF10E27311E60D32722654EF184C031A77B5AE1F8ABAE8891732710AFEE31
                                                                                                                                                                    SHA-512:A902080FF8EE0D9AEFFA0B86E7980457A4E3705789529C82679766580DF0DC17535D858FBE50731E00549932F6D49011868DEE4181C6716C36379AD194B0ED69
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Yara Hits:
                                                                                                                                                                    • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exe, Author: Joe Security
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0.................. ... ....@.. .......................`............@.................................M...O.... ...................)...@..........8............................................ ............... ..H............text...p.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......XJ......................$.........................................{D...*..{E...*V.(F.....}D.....}E...*...0..A........u1.......4.,/(G....{D....{D...oH...,.(I....{E....{E...oJ...*.*.*. }.o )UU.Z(G....{D...oK...X )UU.Z(I....{E...oL...X*...0..b........r...p......%..{D......%q4....4...-.&.+...4...oM....%..{E......%q5....5...-.&.+...5...oM....(N...*..{O...*..{P...*V.(F.....}O.....}P...*.0..A........u6.......4.,/(G....{O....{O...oH...,.(I....{P....{P...oJ...*.*.*. 1.c. )UU.

                                                                                                                                                                    C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exe.config

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):266
                                                                                                                                                                    Entropy (8bit):4.842791478883622
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
                                                                                                                                                                    MD5:728175E20FFBCEB46760BB5E1112F38B
                                                                                                                                                                    SHA1:2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
                                                                                                                                                                    SHA-256:87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
                                                                                                                                                                    SHA-512:FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

                                                                                                                                                                    C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsCredentialProvider.dll

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):842248
                                                                                                                                                                    Entropy (8bit):6.268561504485627
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12288:q9vy8YABMuiAoPyEIrJs7jBjaau+EAaMVtw:P8Y4MuiAoPyZrJ8jrvDVtw
                                                                                                                                                                    MD5:BE74AB7A848A2450A06DE33D3026F59E
                                                                                                                                                                    SHA1:21568DCB44DF019F9FAF049D6676A829323C601E
                                                                                                                                                                    SHA-256:7A80E8F654B9DDB15DDA59AC404D83DBAF4F6EAFAFA7ECBEFC55506279DE553D
                                                                                                                                                                    SHA-512:2643D649A642220CEEE121038FE24EA0B86305ED8232A7E5440DFFC78270E2BDA578A619A76C5BB5A5A6FE3D9093E29817C5DF6C5DD7A8FBC2832F87AA21F0CC
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}....}H..}H..}H.d~I..}H.dxIG.}H.dyI..}H..xI..}H..yI..}H..~I..}H..|H8.}H..}H..}H2.}I..}H2..I..}HRich..}H........PE..d.....Gf.........." ...'.P...........H....................................... ......q.....`......................................... ...t....................P...y.......(......,4.....T.......................(.......@............`...............................text....O.......P.................. ..`.rdata...z...`...|...T..............@..@.data....d.......0..................@....pdata...y...P...z..................@..@_RDATA...............z..............@..@.reloc..,4.......6...|..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsFileManager.exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):81688
                                                                                                                                                                    Entropy (8bit):5.8618809599146005
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:1536:Ety9l44Kzb1I5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7j27Vy:PvqukLdn2s
                                                                                                                                                                    MD5:1AEE526DC110E24D1399AFFCCD452AB3
                                                                                                                                                                    SHA1:04DB0E8772933BC57364615D0D104DC2550BD064
                                                                                                                                                                    SHA-256:EBD04A4540D6E76776BD58DEEA627345D0F8FBA2C04CC65BE5E979A8A67A62A1
                                                                                                                                                                    SHA-512:482A8EE35D53BE907BE39DBD6C46D1F45656046BACA95630D1F07AC90A66F0E61D41F940FB166677AC4D5A48CF66C28E76D89912AED3D673A80737732E863851
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....o..........."...0..@...........^... ...`....@.. .......................`.......$....@..................................^..O....`...................)...@.......]..8............................................ ............... ..H............text....>... ...@.................. ..`.rsrc........`.......B..............@..@.reloc.......@......................@..B.................^......H....... +..@2..................`]........................................(....*^.(.......;...%...}....*:.(......}....*:.(......}....*:.(......}....*....0..........s>....(....(....(....(....(.....(....(......s....}B....s....}C....~@...%-.&~?.....<...s ...%.@...o...+.....@...s ...o...+......A...s!...o...+}D.......B...s"...o...+.......(#...&......(#...& .... ...........($...&s....t......r...prs..p(%...(&...~>...%-.&...'...s(...%.>.....A...().......(*........(+...o,...(-...t....

                                                                                                                                                                    C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsFileManager.exe.config

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):266
                                                                                                                                                                    Entropy (8bit):4.842791478883622
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
                                                                                                                                                                    MD5:728175E20FFBCEB46760BB5E1112F38B
                                                                                                                                                                    SHA1:2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
                                                                                                                                                                    SHA-256:87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
                                                                                                                                                                    SHA-512:FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

                                                                                                                                                                    C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\system.config

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:XML 1.0 document, ASCII text, with very long lines (472), with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):962
                                                                                                                                                                    Entropy (8bit):5.79919391290848
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24:2dL9hK6E4dl/57uta7eC6vIhzQzLoI/4lBvH:chh7HH56UKCzhz+EgYBv
                                                                                                                                                                    MD5:F9DCEDD27B9D662872FDB1DA7D0E3814
                                                                                                                                                                    SHA1:B0C359A1DDB6DB09E6244B3ACD5446EB98EEDB7D
                                                                                                                                                                    SHA-256:090D949D2ABAC1E92E36F21583F78F47946507FA057EA5BD47F681D4C3829956
                                                                                                                                                                    SHA-512:DCEF7B9880F9D8A2ECA4A29BAFFA5A63AD459E03B207C39D198A814D6D34C9E468EA6DAD971E447D52391E4ED85C21A935063BA54E81AC9AF974120A13D98882
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="ClientLaunchParametersConstraint" serializeAs="String">.. <value>?h=instance-moi41i-relay.screenconnect.com&amp;p=443&amp;k=BgIAAACkAABSU0ExAAgAAAEAAQCtUXkVr37HxSNSKxbtVhrTqFy7qJEmo6oCjc91wFOvR4MUBL0kG%2fPw0Y6O4Cbp7p%2bPwDDGLRq%2fNEgwH7S00d6wq1MfdBFm9Uj%2f4fypFZ638LE3OcnK3GXv9nhEoZ1FF8a9u5e0J2AODxPEA5zAmcZC%2b7QZoOfCFaWBpymeq6yYlchLnp1mxk8YwdX7eUAaEm9dE2I95SghGZoVVq0fNyXOlQyIf5EHMgY9Z1LVbVieXeSWVl3znzwAO%2f2y0TpiXGxUUGXL5LRto6Is%2bwKhhKCzwCy3hm8ZX1L10%2fafGHE8wmaJEDg1ddSksTCut%2fYCxPRx7MSQDUTkMhfPMZ4NO3HW</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                                                                                                    C:\ProgramData\Microsoft\Network\Downloader\edb.log

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1310720
                                                                                                                                                                    Entropy (8bit):1.3073773716107835
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvry:KooCEYhgYEL0In
                                                                                                                                                                    MD5:A911691014302D77D1E1AD750FDEF722
                                                                                                                                                                    SHA1:F17BF849B6AD8B343E1D7CA8F5BEC66F3210FD98
                                                                                                                                                                    SHA-256:735EC84D8086FC8146D618584477D4083D940E60364E278B0A95881A12349533
                                                                                                                                                                    SHA-512:54F0B6EF43B284A272478821FF4CDF9B6FD6466713CBD55089DE20DDC0F9AA5E4AD14C5F5B41E8067B0DB11761E91048697D9DE424A7D9D1A3701F036A76E5E8
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                    File Type:Extensible storage engine DataBase, version 0x620, checksum 0x301c9517, page size 16384, DirtyShutdown, Windows version 10.0
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1310720
                                                                                                                                                                    Entropy (8bit):0.42217614838669787
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:1536:5SB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:5aza/vMUM2Uvz7DO
                                                                                                                                                                    MD5:0B9B7BC1A3FDCAD3A25902052E07AE65
                                                                                                                                                                    SHA1:C105F38481BCE8A260B52AE375BF3E69D1F8D582
                                                                                                                                                                    SHA-256:44BC75FB634CB68913EC3DB2E125E067CEAE78221DE6B9F26B22EDE6AC7983F0
                                                                                                                                                                    SHA-512:CDDDF3E87286051891AC1D357185268BDF374D71026E3E5920695040B1439BDA02CA1E79A9D99E661185607D84F9D1335826E2F8FD2650B8087397984D3BB5A7
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:0...... .......A.......X\...;...{......................0.!..........{A..!...|w.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{.......................................!...|w......................!...|w..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):16384
                                                                                                                                                                    Entropy (8bit):0.07722201838996665
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:xnEYebdlvjn13a/3bRYlYllcVO/lnlZMxZNQl:NEzbdx53qeIOewk
                                                                                                                                                                    MD5:9644F0D17D6BD9C6047A23C93E59CDD7
                                                                                                                                                                    SHA1:D803525D21C294905A51B9E779CDDC048E98E6E6
                                                                                                                                                                    SHA-256:993A3B302CF557DB950F7B9B6627CFDBD8EFC48BBED5A1D974504BE27E893FE1
                                                                                                                                                                    SHA-512:6E4A18A6CA5F3B36123C36489FF57FEF6C7A5F88DA67D5D05AF09D29D381199FF38D93724EFEA8117350FAA8006742B64B5E0F0C5BC496666ADF1A3140EBD240
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:.........................................;...{...!...|w......{A..............{A......{A..........{A].....................!...|w.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NotaFiscalOnline.ClientSetup.ex#.exe.log

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exe
                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):321
                                                                                                                                                                    Entropy (8bit):5.36509199858051
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTrM3RJoDLIP12MUAvvR+uCv:Q3La/KDLI4MWuPTArkvoDLI4MWuCv
                                                                                                                                                                    MD5:1CF2352B684EF57925D98E766BA897F2
                                                                                                                                                                    SHA1:6E8CB2C1143E9D9D1211BAA811FE4CAA49C08B55
                                                                                                                                                                    SHA-256:43C3FB3C0B72A899C5442DAC8748D019D800E0A9421D3677EB96E196ED285290
                                                                                                                                                                    SHA-512:9F2D6F89453C867386A65A04FF96067FC3B23A99A4BCE0ECD227E130F409069FE6DD202D4839CBF204C3F204EC058D6CDFDADA7DD212BC2356D74FEC97F22061
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):746
                                                                                                                                                                    Entropy (8bit):5.349174276064173
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhaOK9eDLI4MNJK9P/JNTK9yirkvoDLb:ML9E4KlKDE4KhKiKhPKIE4oKNzKogE4P
                                                                                                                                                                    MD5:ED994980CB1AABB953B2C8ECDC745E1F
                                                                                                                                                                    SHA1:9E9D3E00A69FC862F4D3C30F42BF26693A2D2A21
                                                                                                                                                                    SHA-256:D23B54CCF9F6327FE1158762D4E5846649699A7B78418D056A197835ED1EBE79
                                                                                                                                                                    SHA-512:61DFC93154BCD734B9836A6DECF93674499FF533E2B9A1188886E2CBD04DF35538368485AA7E775B641ADC120BAE1AC2551B28647951C592AA77F6747F0E9187
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\MSI2520.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1088392
                                                                                                                                                                    Entropy (8bit):7.789940577622617
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24576:QUUGGHn+rUGemcPe9MpKL4Plb2sZWV+tLv0QYu5OPthT+gd:jGHpRPqMpvlqs0O4iO2k
                                                                                                                                                                    MD5:8A8767F589EA2F2C7496B63D8CCC2552
                                                                                                                                                                    SHA1:CC5DE8DD18E7117D8F2520A51EDB1D165CAE64B0
                                                                                                                                                                    SHA-256:0918D8AB2237368A5CEC8CE99261FB07A1A1BEEDA20464C0F91AF0FE3349636B
                                                                                                                                                                    SHA-512:518231213CA955ACDF37B4501FDE9C5B15806D4FC166950EB8706E8D3943947CF85324FAEE806D7DF828485597ECEFFCFA05CA1A5D8AB1BD51ED12DF963A1FE4
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S.c.2.0.2.0.2.0..|0.2.0..H0.2.0.Jq0.2.0.2.0.2.0..I0.2.0..y0.2.0..x0.2.0...0.2.0Rich.2.0................PE..L...9..P...........!.........H.......i.......................................p............@..............................*..l...x....@.......................P..d.......................................@...............h............................text............................... ..`.rdata..............................@..@.data....-..........................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\MSI2520.tmp-\CustomAction.config

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                    File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):234
                                                                                                                                                                    Entropy (8bit):4.977464602412109
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:JiMVBdTMkIffVymRMT4/0xC/C7VrfC7VNQpuAW4QIT:MMHd413VymhsS+Qg93xT
                                                                                                                                                                    MD5:6F52EBEA639FD7CEFCA18D9E5272463E
                                                                                                                                                                    SHA1:B5E8387C2EB20DD37DF8F4A3B9B0E875FA5415E3
                                                                                                                                                                    SHA-256:7027B69AB6EBC9F3F7D2F6C800793FDE2A057B76010D8CFD831CF440371B2B23
                                                                                                                                                                    SHA-512:B5960066430ED40383D39365EADB3688CADADFECA382404924024C908E32C670AFABD37AB41FF9E6AC97491A5EB8B55367D7199002BF8569CF545434AB2F271A
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:.<?xml version="1.0" encoding="utf-8" ?>..<configuration>.. <startup useLegacyV2RuntimeActivationPolicy="true">.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>..</configuration>

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\MSI2520.tmp-\Microsoft.Deployment.Compression.Cab.dll

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):49152
                                                                                                                                                                    Entropy (8bit):4.62694170304723
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:sqbC2wmdVdX9Y6BCH+C/FEQl2ifnxwr02Gy/G4Xux+bgHGvLw4:sAtXPC/Cifnxs02Gyu4Xu0MeR
                                                                                                                                                                    MD5:77BE59B3DDEF06F08CAA53F0911608A5
                                                                                                                                                                    SHA1:A3B20667C714E88CC11E845975CD6A3D6410E700
                                                                                                                                                                    SHA-256:9D32032109FFC217B7DC49390BD01A067A49883843459356EBFB4D29BA696BF8
                                                                                                                                                                    SHA-512:C718C1AFA95146B89FC5674574F41D994537AF21A388335A38606AEC24D6A222CBCE3E6D971DFE04D86398E607815DF63A54DA2BB96CCF80B4F52072347E1CE6
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F.Y.........." ..0...... ........... ........... ...............................$....@....................................O.................................................................................... ............... ..H............text... .... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\MSI2520.tmp-\Microsoft.Deployment.Compression.dll

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):36864
                                                                                                                                                                    Entropy (8bit):4.340550904466943
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:384:GqJxldkxhW9N5u8IALLU0X9Z1kTOPJlqE:GqJxl6xsPIA9COxlqE
                                                                                                                                                                    MD5:4717BCC62EB45D12FFBED3A35BA20E25
                                                                                                                                                                    SHA1:DA6324A2965C93B70FC9783A44F869A934A9CAF7
                                                                                                                                                                    SHA-256:E04DE7988A2A39931831977FA22D2A4C39CF3F70211B77B618CAE9243170F1A7
                                                                                                                                                                    SHA-512:BB0ABC59104435171E27830E094EAE6781D2826ED2FC9009C8779D2CA9399E38EDB1EC6A10C1676A5AF0F7CACFB3F39AC2B45E61BE2C6A8FE0EDB1AF63A739CA
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F.Y.........." ..0..`... .......~... ........... ....................................@.................................X~..O................................... }............................................... ............... ..H............text....^... ...`.................. ..`.rsrc................p..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\MSI2520.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):57344
                                                                                                                                                                    Entropy (8bit):4.657268358041957
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:BLNru62y+VqB4N5SBcDhDxW7ZkCmX2Qv1Sf0AQdleSBRxf+xUI3:BJ2yUGmh2O11AsleyRxf+xt
                                                                                                                                                                    MD5:A921A2B83B98F02D003D9139FA6BA3D8
                                                                                                                                                                    SHA1:33D67E11AD96F148FD1BFD4497B4A764D6365867
                                                                                                                                                                    SHA-256:548C551F6EBC5D829158A1E9AD1948D301D7C921906C3D8D6B6D69925FC624A1
                                                                                                                                                                    SHA-512:E1D7556DAF571C009FE52D6FFE3D6B79923DAEEA39D754DDF6BEAFA85D7A61F3DB42DFC24D4667E35C4593F4ED6266F4099B393EFA426FA29A72108A0EAEDD3E
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F.Y.........." ..0...... ........... ........... ....................... .......t....@.....................................O...................................`................................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\MSI2520.tmp-\Microsoft.Deployment.WindowsInstaller.dll

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):176128
                                                                                                                                                                    Entropy (8bit):5.775360792482692
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
                                                                                                                                                                    MD5:5EF88919012E4A3D8A1E2955DC8C8D81
                                                                                                                                                                    SHA1:C0CFB830B8F1D990E3836E0BCC786E7972C9ED62
                                                                                                                                                                    SHA-256:3E54286E348EBD3D70EAED8174CCA500455C3E098CDD1FCCB167BC43D93DB29D
                                                                                                                                                                    SHA-512:4544565B7D69761F9B4532CC85E7C654E591B2264EB8DA28E60A058151030B53A99D1B2833F11BFC8ACC837EECC44A7D0DBD8BC7AF97FC0E0F4938C43F9C2684
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F.Y.........." ..0...... ......~.... ........... ..............................!|....@.................................,...O.................................................................................... ............... ..H............text....w... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\MSI2520.tmp-\ScreenConnect.Core.dll

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):548864
                                                                                                                                                                    Entropy (8bit):6.034211651049746
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12288:xC2YKhQCNc6kVTplfWL/YTHUYCBdySISYz:HhE6O7WL/EC
                                                                                                                                                                    MD5:14E7489FFEBBB5A2EA500F796D881AD9
                                                                                                                                                                    SHA1:0323EE0E1FAA4AA0E33FB6C6147290AA71637EBD
                                                                                                                                                                    SHA-256:A2E9752DE49D18E885CBD61B29905983D44B4BC0379A244BFABDAA3188C01F0A
                                                                                                                                                                    SHA-512:2110113240B7D803D8271139E0A2439DBC86AE8719ECD8B132BBDA2520F22DC3F169598C8E966AC9C0A40E617219CB8FE8AAC674904F6A1AE92D4AC1E20627CD
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l............." ..0..X...........s... ........... ..............................].....@.................................as..O.......t............................r..8............................................ ............... ..H............text....W... ...X.................. ..`.rsrc...t............Z..............@..@.reloc...............^..............@..B.................s......H........C..,/..................Dr........................................{:...*..{;...*V.(<.....}:.....};...*...0..A........u~.......4.,/(=....{:....{:...o>...,.(?....{;....{;...o@...*.*.*. ... )UU.Z(=....{:...oA...X )UU.Z(?....{;...oB...X*...0..b........r...p......%..{:......%q.........-.&.+.......oC....%..{;......%q.........-.&.+.......oC....(D...*..{E...*..{F...*V.(<.....}E.....}F...*.0..A........u........4.,/(=....{E....{E...o>...,.(?....{F....{F...o@...*.*.*. F.b# )UU.

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\MSI2520.tmp-\ScreenConnect.InstallerActions.dll

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):11776
                                                                                                                                                                    Entropy (8bit):5.273875899788767
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:V8/Qp6lCJuV3jHXtyVNamVNG1YZfCrMmbfHJ7kjvLjbuLd9NEFbM64:y/cBJaLXt2NaheUrMmb/FkjvLjbuZj64
                                                                                                                                                                    MD5:73A24164D8408254B77F3A2C57A22AB4
                                                                                                                                                                    SHA1:EA0215721F66A93D67019D11C4E588A547CC2AD6
                                                                                                                                                                    SHA-256:D727A640723D192AA3ECE213A173381682041CB28D8BD71781524DBAE3DDBF62
                                                                                                                                                                    SHA-512:650D4320D9246AAECD596AC8B540BF7612EC7A8F60ECAA6E9C27B547B751386222AB926D0C915698D0BB20556475DA507895981C072852804F0B42FDDA02B844
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..&...........E... ...`....... ..............................D9....@..................................D..O....`..............................$D..8............................................ ............... ..H............text...4%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc...............,..............@..B.................E......H........'.......................C........................................(....*^.(.......&...%...}....*:.(......}....*:.(......}....*:.(......}....*....0..........s.......}.....s....}.....{....r...p(......,h.{....r...p......%...(.....rS..p.(....~....%-.&~..........s....%......(...+%-.&+.(...........s....(...+&.{....o....-!.{.....{.....{....rc..po....(.....{....o.........{.....{.....{....r}..po....(.....{....o....-..{....r...p......(.....*.{....s .....-..o!.......{....r}..p.o

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\MSI2520.tmp-\ScreenConnect.Windows.dll

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1721856
                                                                                                                                                                    Entropy (8bit):6.639085961200334
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24576:dx5xeYkYFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:dx5xTkYJkGYYpT0+TFiH7efP
                                                                                                                                                                    MD5:9AD3964BA3AD24C42C567E47F88C82B2
                                                                                                                                                                    SHA1:6B4B581FC4E3ECB91B24EC601DAA0594106BCC5D
                                                                                                                                                                    SHA-256:84A09ED81AFC5FF9A17F81763C044C82A2D9E26F852DE528112153EE9AB041D0
                                                                                                                                                                    SHA-512:CE557A89C0FE6DE59046116C1E262A36BBC3D561A91E44DCDA022BEF72CB75742C8B01BEDCC5B9B999E07D8DE1F94C665DD85D277E981B27B6BFEBEAF9E58097
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...y............." ..0..>..........~]... ...`....... ..............................8.....@.................................+]..O....`..|............................\..8............................................ ............... ..H............text....=... ...>.................. ..`.rsrc...|....`.......@..............@..@.reloc...............D..............@..B................_]......H.......t...d..............0....\........................................()...*^.()..........%...}....*:.().....}....*:.().....}....*:.().....}....*..s*...*..s+...*:.(,.....(-...*..{....*"..}....*J.(/........(0...&*:.(,.....(1...*..{2...*"..}2...*.0..(........(3......+.............(0...&..X....i2.*v.(,....s4...}.....s5...}....*v.{.....r...p(...+.....o7....*.0...........o8....+..o9......(...+&.o....-....,..o......*..........."........{..........o:...&.......(.....*....0..L...

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\ScreenConnect\24.3.7.9067\bc180d8c7278c2c2\ScreenConnect.ClientSetup.msi

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exe
                                                                                                                                                                    File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Default, Author: ScreenConnect Software, Keywords: Default, Comments: Default, Template: Intel;1033, Revision Number: {8ED2474F-3FEA-BB0F-7BE5-1BCA7E4AB8D2}, Create Time/Date: Mon Oct 28 17:43:52 2024, Last Saved Time/Date: Mon Oct 28 17:43:52 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.0.1701), Security: 2
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):8241152
                                                                                                                                                                    Entropy (8bit):7.950612409504629
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:98304:vwJ4t1h0cG5FGJRPxow8OzwJ4t1h0cG5hwJ4t1h0cG5lwJ4t1h0cG5:IWh0cGwSWh0cGkWh0cGUWh0cG
                                                                                                                                                                    MD5:337A464F7982C06DB650F17B67400324
                                                                                                                                                                    SHA1:907F81E551F0E924C0D620255532D04FFE6705C7
                                                                                                                                                                    SHA-256:B026D28C32FA25A1837643B411C4CA68DF3F75C6AFF8976ACB0890FA275E0B87
                                                                                                                                                                    SHA-512:06A1EEC0921CB2845B34CFDBA17741DFA006D871BAC4B40BAED707B9C1FFF142609E46910CA436CB63E7FA8BC5941905F447B5B903E90E42B51719B46F1E2460
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Windows\Installer\652b3b.msi

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Default, Author: ScreenConnect Software, Keywords: Default, Comments: Default, Template: Intel;1033, Revision Number: {8ED2474F-3FEA-BB0F-7BE5-1BCA7E4AB8D2}, Create Time/Date: Mon Oct 28 17:43:52 2024, Last Saved Time/Date: Mon Oct 28 17:43:52 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.0.1701), Security: 2
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):8241152
                                                                                                                                                                    Entropy (8bit):7.950612409504629
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:98304:vwJ4t1h0cG5FGJRPxow8OzwJ4t1h0cG5hwJ4t1h0cG5lwJ4t1h0cG5:IWh0cGwSWh0cGkWh0cGUWh0cG
                                                                                                                                                                    MD5:337A464F7982C06DB650F17B67400324
                                                                                                                                                                    SHA1:907F81E551F0E924C0D620255532D04FFE6705C7
                                                                                                                                                                    SHA-256:B026D28C32FA25A1837643B411C4CA68DF3F75C6AFF8976ACB0890FA275E0B87
                                                                                                                                                                    SHA-512:06A1EEC0921CB2845B34CFDBA17741DFA006D871BAC4B40BAED707B9C1FFF142609E46910CA436CB63E7FA8BC5941905F447B5B903E90E42B51719B46F1E2460
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Windows\Installer\652b3d.msi

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Default, Author: ScreenConnect Software, Keywords: Default, Comments: Default, Template: Intel;1033, Revision Number: {8ED2474F-3FEA-BB0F-7BE5-1BCA7E4AB8D2}, Create Time/Date: Mon Oct 28 17:43:52 2024, Last Saved Time/Date: Mon Oct 28 17:43:52 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.0.1701), Security: 2
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):8241152
                                                                                                                                                                    Entropy (8bit):7.950612409504629
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:98304:vwJ4t1h0cG5FGJRPxow8OzwJ4t1h0cG5hwJ4t1h0cG5lwJ4t1h0cG5:IWh0cGwSWh0cGkWh0cGUWh0cG
                                                                                                                                                                    MD5:337A464F7982C06DB650F17B67400324
                                                                                                                                                                    SHA1:907F81E551F0E924C0D620255532D04FFE6705C7
                                                                                                                                                                    SHA-256:B026D28C32FA25A1837643B411C4CA68DF3F75C6AFF8976ACB0890FA275E0B87
                                                                                                                                                                    SHA-512:06A1EEC0921CB2845B34CFDBA17741DFA006D871BAC4B40BAED707B9C1FFF142609E46910CA436CB63E7FA8BC5941905F447B5B903E90E42B51719B46F1E2460
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Windows\Installer\MSI2D9C.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):423495
                                                                                                                                                                    Entropy (8bit):6.578155322646903
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6144:KuH2aCGw1ST1wQLdqv5uH2aCGw1ST1wQLdqvt:KuH2anwohwQUv5uH2anwohwQUvt
                                                                                                                                                                    MD5:B601E216525B235BEF492CBEDE9F7FC0
                                                                                                                                                                    SHA1:6DE1C964D05EC72994B6C05CC4F7835F073393DD
                                                                                                                                                                    SHA-256:9949AD2DC9C2B557297347D2908D6A2D9AE9566F7657D147EABA1AFDDF4E6D72
                                                                                                                                                                    SHA-512:8F6C70FD8AE94709A168788F0A679C46C53250E77D3CB46C57CD6C8634E85B98A06E1EE678343047875AC4571DDDAAE058F25516ADCEA184B4AC1E6A77A3945F
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Yara Hits:
                                                                                                                                                                    • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Windows\Installer\MSI2D9C.tmp, Author: Joe Security
                                                                                                                                                                    Preview:...@IXOS.@.....@#..Y.@.....@.....@.....@.....@.....@......&.{8ED2474F-3FEA-BB0F-7BE5-1BCA7E4AB8D2}'.ScreenConnect Client (bc180d8c7278c2c2)..ScreenConnect.ClientSetup.msi.@.....@.....@.....@......DefaultIcon..&.{8ED2474F-3FEA-BB0F-7BE5-1BCA7E4AB8D2}.....@.....@.....@.....@.......@.....@.....@.......@....'.ScreenConnect Client (bc180d8c7278c2c2)......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{85E972A2-ADDC-AEC6-9B6B-C4279751AB13}^.C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.dll.@.......@.....@.....@......&.{5B8C03F1-BFD0-62EB-2AB5-F8435CB476AD}f.C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsBackstageShell.exe.@.......@.....@.....@......&.{5E913D78-93D2-DBC0-0EFD-192C823FC83F}c.C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsFileMa

                                                                                                                                                                    C:\Windows\Installer\MSI2DDC.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):207360
                                                                                                                                                                    Entropy (8bit):6.573348437503042
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
                                                                                                                                                                    MD5:BA84DD4E0C1408828CCC1DE09F585EDA
                                                                                                                                                                    SHA1:E8E10065D479F8F591B9885EA8487BC673301298
                                                                                                                                                                    SHA-256:3CFF4AC91288A0FF0C13278E73B282A64E83D089C5A61A45D483194AB336B852
                                                                                                                                                                    SHA-512:7A38418F6EE8DBC66FAB2CD5AD8E033E761912EFC465DAA484858D451DA4B8576079FE90FD3B6640410EDC8B3CAC31C57719898134F246F4000D60A252D88290
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........AF../.../.../.'D..../.'D..../.'D..../...,.../...+.../...*.../......./......./.....n./.*.*.../.*./.../.*...../....../.*.-.../.Rich../.........................PE..L...pG.Y...........!.........L......&.....................................................@.................................P........P..x....................`......P...T...............................@...............<............................text...+........................... ..`.rdata..*...........................@..@.data...."... ......................@....rsrc...x....P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Windows\Installer\MSI2FC1.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):207360
                                                                                                                                                                    Entropy (8bit):6.573348437503042
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
                                                                                                                                                                    MD5:BA84DD4E0C1408828CCC1DE09F585EDA
                                                                                                                                                                    SHA1:E8E10065D479F8F591B9885EA8487BC673301298
                                                                                                                                                                    SHA-256:3CFF4AC91288A0FF0C13278E73B282A64E83D089C5A61A45D483194AB336B852
                                                                                                                                                                    SHA-512:7A38418F6EE8DBC66FAB2CD5AD8E033E761912EFC465DAA484858D451DA4B8576079FE90FD3B6640410EDC8B3CAC31C57719898134F246F4000D60A252D88290
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........AF../.../.../.'D..../.'D..../.'D..../...,.../...+.../...*.../......./......./.....n./.*.*.../.*./.../.*...../....../.*.-.../.Rich../.........................PE..L...pG.Y...........!.........L......&.....................................................@.................................P........P..x....................`......P...T...............................@...............<............................text...+........................... ..`.rdata..*...........................@..@.data...."... ......................@....rsrc...x....P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Windows\Installer\SourceHash{8ED2474F-3FEA-BB0F-7BE5-1BCA7E4AB8D2}

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):20480
                                                                                                                                                                    Entropy (8bit):1.1712283938447345
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:JSbX72FjVAGiLIlHVRpIh/7777777777777777777777777vDHFalHiPnw7rl0i5:JDQI5wo9KnbF
                                                                                                                                                                    MD5:213142F2F866C39C3766DE6A84B2E027
                                                                                                                                                                    SHA1:3DA2899E3245FAA65EF1E3085690F1BBAFD8A56E
                                                                                                                                                                    SHA-256:FE552B49C9041AC9498DFEE564FE5AB6ABB900FEBD8875EFBB9AB7238DF78D35
                                                                                                                                                                    SHA-512:3C513CA1CC3E8F187919B5C34E114CE753BA0B8890B3D5EFD4D59A8069543B004BA6D9B11AFD1793D9C367DE1A9DD065E4CFF21A58454738A15406CBED3EA084
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Windows\Installer\inprogressinstallinfo.ipi

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):20480
                                                                                                                                                                    Entropy (8bit):1.8047535349712238
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:F8PhMuRc06WXzuFT5R9UBhqcq56Adu7SiGU4dFGeKeaahIyYCfntoNr2Adu7SIDB:ohM1zFTC8p6fudFG5ahIwP
                                                                                                                                                                    MD5:D448B0565DB456E6DCDFF65DBB5C2E2B
                                                                                                                                                                    SHA1:787B3A9A7589F367312A8C68A4DF993AB9B7E2C6
                                                                                                                                                                    SHA-256:7107F8642186AB716BAA1501BEF1ADB8248227787F9C0B081BE22E4CFB3BD492
                                                                                                                                                                    SHA-512:45554816D58C8F0D27D92EC731979F3EDE370D50A76A86A018DAE7B5463C36EF7D663DCFF0D2B123B1377B53B64EA1CA041D601B26590A7925F1984D8B415445
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Yara Hits:
                                                                                                                                                                    • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Windows\Installer\inprogressinstallinfo.ipi, Author: Joe Security
                                                                                                                                                                    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Windows\Installer\{8ED2474F-3FEA-BB0F-7BE5-1BCA7E4AB8D2}\DefaultIcon

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:MS Windows icon resource - 3 icons, 16x16 with PNG image data, 16 x 16, 8-bit colormap, non-interlaced, 4 bits/pixel, 32x32 with PNG image data, 32 x 32, 1-bit colormap, non-interlaced, 4 bits/pixel
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):435
                                                                                                                                                                    Entropy (8bit):5.289734780210945
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:Kvv/7tghWPjScQZ/Ev/739Jgh5TZYR/v/71XfghNeZ:QOZZq9JOz0dONeZ
                                                                                                                                                                    MD5:F34D51C3C14D1B4840AE9FF6B70B5D2F
                                                                                                                                                                    SHA1:C761D3EF26929F173CEB2F8E01C6748EE2249A8A
                                                                                                                                                                    SHA-256:0DD459D166F037BB8E531EB2ECEB2B79DE8DBBD7597B05A03C40B9E23E51357A
                                                                                                                                                                    SHA-512:D6EEB5345A5A049A87BFBFBBBEBFBD9FBAEC7014DA41DB1C706E8B16DDEC31561679AAE9E8A0847098807412BD1306B9616C8E6FCFED8683B4F33BD05ADE38D1
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:..............z...6... ..............00..........0....PNG........IHDR.............(-.S....PLTE....22.u......tRNS.@..f..."IDATx.c` .0"...$.(......SC..Q8....9b.i.Xa.....IEND.B`..PNG........IHDR... ... .....I......PLTE....22.u......tRNS.@..f...(IDATx.c`...... ... D.......vb.....A`..(.-s...q....IEND.B`..PNG........IHDR...0...0.....m.k.....PLTE....22.u......tRNS.@..f...+IDATx.c` .......Q...S.@..DQu...4...(.}DQD...3x........IEND.B`.

                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):432221
                                                                                                                                                                    Entropy (8bit):5.3751737297864635
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgaux:zTtbmkExhMJCIpEro
                                                                                                                                                                    MD5:1BC1CA033C8D675EEE5AF2E409F9B99A
                                                                                                                                                                    SHA1:3FA92C4D20CD0C03C680F692111F4403062CAB51
                                                                                                                                                                    SHA-256:32C8691BD3EDF769B2676BAA52B21543EFE11E51B9A116199CE74F4F4D0A3325
                                                                                                                                                                    SHA-512:B443447D3D7660772B8B51D98BB9E598D6C6283EAC1E25C8B5914150D1401468BF53E502B45731E93F34DC39AF2C47048E499DDACE6591E5DAD1BE8167977320
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

                                                                                                                                                                    C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):55
                                                                                                                                                                    Entropy (8bit):4.306461250274409
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
                                                                                                                                                                    MD5:DCA83F08D448911A14C22EBCACC5AD57
                                                                                                                                                                    SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                                                                                                                                                                    SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                                                                                                                                                                    SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

                                                                                                                                                                    C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\2kgdghcx.newcfg

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe
                                                                                                                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):584
                                                                                                                                                                    Entropy (8bit):5.016619679600349
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlbSe69ip3JBQv/vXbAa3xT:2dL9hK6E46YPRbTKidJBGvH
                                                                                                                                                                    MD5:A36D7516FE29022DEA82BEFEE877573E
                                                                                                                                                                    SHA1:8C3508184A7D7ABAA998C6438D64A878473D16A4
                                                                                                                                                                    SHA-256:8ED4DF0483FFD45F4865F5D2305285F6287EF90E8E9A2841D234A066BEC8B946
                                                                                                                                                                    SHA-512:3B0AA147A9653E35B13A1BA420D57DE4AE9E5D029299D75C4882976585F49F704AD86E4EAF6C9B0498B1440287771DA31DEF3DF244C8CA34E06A4C66ABACCF01
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-moi41i-relay.screenconnect.com=51.89.135.228-20%2f12%2f2024%2021%3a33%3a07</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                                                                                                    C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\2quoghav.newcfg

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe
                                                                                                                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):584
                                                                                                                                                                    Entropy (8bit):5.018221900438616
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlbSe69ip3e/vXbAa3xT:2dL9hK6E46YPRbTKidEvH
                                                                                                                                                                    MD5:FB73360AA874AD1C70069CE73CB12FA2
                                                                                                                                                                    SHA1:5F3B209B0FBF9F28AC696E25756D21F4F5FA09C5
                                                                                                                                                                    SHA-256:41C15DF96DDBF49240B4B260B3E37463BE4BEDA1CFE4855EEE58AD8E5AD6FAA7
                                                                                                                                                                    SHA-512:0E3E74144C05277B5962CAED7BE3EB05B5A6740A3DDCA348CBFDDFAEBB0472D866371AB12E7A66AC1215FDB9FB39A18AAA76C8C988B49E3171CCD9CB9C3AA3D3
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-moi41i-relay.screenconnect.com=51.89.135.228-20%2f12%2f2024%2021%3a33%3a16</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                                                                                                    C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\fm0i4g4x.newcfg

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe
                                                                                                                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                    Category:modified
                                                                                                                                                                    Size (bytes):584
                                                                                                                                                                    Entropy (8bit):5.014388285785315
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlbSe69ip3m/vXbAa3xT:2dL9hK6E46YPRbTKid8vH
                                                                                                                                                                    MD5:656C1259298EE9DE226D1DD44ED11A3F
                                                                                                                                                                    SHA1:F02B2E7F099FE80D699C4077F06C5AC58D3EF3C4
                                                                                                                                                                    SHA-256:F23A7AE9605C40AD68DFC2966D2BD3A514476C77BDEC6F7305E5579757497027
                                                                                                                                                                    SHA-512:8810DCB05618C83F82E49388CDC3B3A6CE5DBE45F2AB23143A2D4C2125136A5312F5EBD6243C203369B0AF89C12C796A7A29CE5700A7F17BA643378DF3FEC941
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-moi41i-relay.screenconnect.com=51.89.135.228-20%2f12%2f2024%2021%3a35%3a10</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                                                                                                    C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\hsaej4wc.newcfg

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe
                                                                                                                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):584
                                                                                                                                                                    Entropy (8bit):5.013890864457484
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlbSe69ip3Y/vXbAa3xT:2dL9hK6E46YPRbTKidOvH
                                                                                                                                                                    MD5:000FEE48BEA8F4F97384602E58A28E82
                                                                                                                                                                    SHA1:12B104ED69FCF3C1B73B3510FB23425270420D0F
                                                                                                                                                                    SHA-256:72B6533B1DAE605EB8E166C7C585B0D1DB13CA8BADF7C7283579433FDA3A9E17
                                                                                                                                                                    SHA-512:224DF4B1A80A377D11DE81234FF8426DBB94C388968F794C7F9612A69F0E63D211E40E252222CDE6FB9CB017AAD56239D275DFC816EBF6F6D84D749A8C347D4F
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-moi41i-relay.screenconnect.com=51.89.135.228-20%2f12%2f2024%2021%3a33%3a10</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                                                                                                    C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\hudqk2hi.newcfg

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe
                                                                                                                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):584
                                                                                                                                                                    Entropy (8bit):5.013865782629225
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlbSe69ip3L/vXbAa3xT:2dL9hK6E46YPRbTKidTvH
                                                                                                                                                                    MD5:FE6B26966D411ECE0C4105072F016C28
                                                                                                                                                                    SHA1:A5A59D842C56A773231BBACA781020964270C7BE
                                                                                                                                                                    SHA-256:2A375CD6A95DE3544584638DAC04C937583D2CDECE52262847FAEFACF51B6267
                                                                                                                                                                    SHA-512:52768AD8D5B5EE9102E1273F34725B724D6A6017C2A0F44D82EC9FBD5D7C46337AC4FF2B6663E5801361410BD9CD2430C4AD46DBBF360EDDC60D0C4FB882202B
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-moi41i-relay.screenconnect.com=51.89.135.228-20%2f12%2f2024%2021%3a34%3a12</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                                                                                                    C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\jtdl3m1a.newcfg

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe
                                                                                                                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):584
                                                                                                                                                                    Entropy (8bit):5.015819786776087
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlbSe69ip34/vXbAa3xT:2dL9hK6E46YPRbTKiduvH
                                                                                                                                                                    MD5:2B39C4FB9E9D111B81757593E7BC79F0
                                                                                                                                                                    SHA1:5816D629C9517CF6804EEFBE65EAECBC4F493D6F
                                                                                                                                                                    SHA-256:5970EC44A8FC3469D40BA54E3400D64505494DEF49021E2936A5E6AF1465DF0F
                                                                                                                                                                    SHA-512:57224DCD9CCE8C04F5B9CB57F25CF4F488BF6444EC23A513790DE6BDCEC4CEC2E398CA7261786D3FBFAF55BE94B1E1C6097F8894C852FBAAFAD3431C9063DE45
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-moi41i-relay.screenconnect.com=51.89.135.228-20%2f12%2f2024%2021%3a34%3a33</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                                                                                                    C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\kyp4jwo2.newcfg

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe
                                                                                                                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):584
                                                                                                                                                                    Entropy (8bit):5.01455458973643
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlbSe69ip3f/vXbAa3xT:2dL9hK6E46YPRbTKidnvH
                                                                                                                                                                    MD5:6568C608E7977DD5CE00E21F75BD89A7
                                                                                                                                                                    SHA1:55F0F3B514D685A6317AA86C8849020523AFDBF0
                                                                                                                                                                    SHA-256:D02EFEDCF6A7AD6A4C7584913D5D6CC81BCC872594FA6D8EEE26CB44F2486940
                                                                                                                                                                    SHA-512:C98F3DFFB65DFBD16FBD1EA29EF529898D16C8DA58FA7098534E07E43FD5F6B99300F0F349069DDFB861DDE227ECF8954E81A1EA90377128E065F5A4B013CFD4
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-moi41i-relay.screenconnect.com=51.89.135.228-20%2f12%2f2024%2021%3a33%3a13</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                                                                                                    C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\m0qq0kbb.newcfg

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe
                                                                                                                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):584
                                                                                                                                                                    Entropy (8bit):5.0154656667495106
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlbSe69ip3Ug/vXbAa3xT:2dL9hK6E46YPRbTKidUGvH
                                                                                                                                                                    MD5:CB92904E97AE59269598B4F365FA080E
                                                                                                                                                                    SHA1:823EEAE6D5425B74FC69AF5A1F827BABB6DFD244
                                                                                                                                                                    SHA-256:FED5400C4FB7B70B3DA8EAED28DD9C7B306681E8F59ACC5F136D3675069D17CB
                                                                                                                                                                    SHA-512:B4DEC5025441959C2849A9A1FC97B0E500EE3EB40D13C71433E32CFE35EC72B24E5D01215084FEC15F0F4118FC94AB87399E34C2AF7912D9FC0798A1D5BBA84F
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-moi41i-relay.screenconnect.com=51.89.135.228-20%2f12%2f2024%2021%3a33%3a51</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                                                                                                    C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\rqtlytpw.newcfg

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe
                                                                                                                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):584
                                                                                                                                                                    Entropy (8bit):5.017355055529923
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlbSe69ip3R/vXbAa3xT:2dL9hK6E46YPRbTKid5vH
                                                                                                                                                                    MD5:45759B8D225A04B4BEF0B3C9ECC0F68F
                                                                                                                                                                    SHA1:FD8E8F9BD3B0F7444FC58143FF4633015B5DC871
                                                                                                                                                                    SHA-256:757607364C8029DA4F5686067881093117EE41DCE0429B3059DDC89D4D5777AD
                                                                                                                                                                    SHA-512:D6BDF3883FABF26B48D70C4D2AF5F951B0F326F68B5C2B35637DF126743D5D91047576A64668D4E262D878C979ACA64109A2A5BA6CD356CB597A39D87686A8A2
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-moi41i-relay.screenconnect.com=51.89.135.228-20%2f12%2f2024%2021%3a33%3a59</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                                                                                                    C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\user.config (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe
                                                                                                                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):584
                                                                                                                                                                    Entropy (8bit):5.016619679600349
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlbSe69ip3JBQv/vXbAa3xT:2dL9hK6E46YPRbTKidJBGvH
                                                                                                                                                                    MD5:A36D7516FE29022DEA82BEFEE877573E
                                                                                                                                                                    SHA1:8C3508184A7D7ABAA998C6438D64A878473D16A4
                                                                                                                                                                    SHA-256:8ED4DF0483FFD45F4865F5D2305285F6287EF90E8E9A2841D234A066BEC8B946
                                                                                                                                                                    SHA-512:3B0AA147A9653E35B13A1BA420D57DE4AE9E5D029299D75C4882976585F49F704AD86E4EAF6C9B0498B1440287771DA31DEF3DF244C8CA34E06A4C66ABACCF01
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-moi41i-relay.screenconnect.com=51.89.135.228-20%2f12%2f2024%2021%3a33%3a07</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                                                                                                    C:\Windows\Temp\~DF128E7F83555EDFF9.TMP

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):32768
                                                                                                                                                                    Entropy (8bit):1.4238943318896713
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:mpkuwth8FXzvT5aUJ9UBhqcq56Adu7SiGU4dFGeKeaahIyYCfntoNr2Adu7SIDB:GkSRTot8p6fudFG5ahIwP
                                                                                                                                                                    MD5:261B76AEA8EB8800835B06BD8453A938
                                                                                                                                                                    SHA1:951846A1A9D4461C9A9B348576AC3F48B141BD02
                                                                                                                                                                    SHA-256:CF2D7E509DC1BAF97E3E26396E47737872C21A573B4D46F1CEC5DD1BF2078CE1
                                                                                                                                                                    SHA-512:66EC61B16587FFE748116D4504C4A700F2E5504F4E1B6CFC3B8B6CC6F7B5329C374C7903CC0DB13DB5325B656876FFBC33ED4FD095B57E46D58C1C8E4DBF819D
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Yara Hits:
                                                                                                                                                                    • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Windows\Temp\~DF128E7F83555EDFF9.TMP, Author: Joe Security
                                                                                                                                                                    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Windows\Temp\~DF138D504A1B9715E2.TMP

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):512
                                                                                                                                                                    Entropy (8bit):0.0
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3::
                                                                                                                                                                    MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                                    SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                                    SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                                    SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Windows\Temp\~DF27C5C54D3C794142.TMP

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):512
                                                                                                                                                                    Entropy (8bit):0.0
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3::
                                                                                                                                                                    MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                                    SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                                    SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                                    SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Windows\Temp\~DF2D5C6F810C43607F.TMP

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):32768
                                                                                                                                                                    Entropy (8bit):1.4238943318896713
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:mpkuwth8FXzvT5aUJ9UBhqcq56Adu7SiGU4dFGeKeaahIyYCfntoNr2Adu7SIDB:GkSRTot8p6fudFG5ahIwP
                                                                                                                                                                    MD5:261B76AEA8EB8800835B06BD8453A938
                                                                                                                                                                    SHA1:951846A1A9D4461C9A9B348576AC3F48B141BD02
                                                                                                                                                                    SHA-256:CF2D7E509DC1BAF97E3E26396E47737872C21A573B4D46F1CEC5DD1BF2078CE1
                                                                                                                                                                    SHA-512:66EC61B16587FFE748116D4504C4A700F2E5504F4E1B6CFC3B8B6CC6F7B5329C374C7903CC0DB13DB5325B656876FFBC33ED4FD095B57E46D58C1C8E4DBF819D
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Yara Hits:
                                                                                                                                                                    • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Windows\Temp\~DF2D5C6F810C43607F.TMP, Author: Joe Security
                                                                                                                                                                    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Windows\Temp\~DF31A1C5F44E3BDC22.TMP

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):20480
                                                                                                                                                                    Entropy (8bit):1.8047535349712238
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:F8PhMuRc06WXzuFT5R9UBhqcq56Adu7SiGU4dFGeKeaahIyYCfntoNr2Adu7SIDB:ohM1zFTC8p6fudFG5ahIwP
                                                                                                                                                                    MD5:D448B0565DB456E6DCDFF65DBB5C2E2B
                                                                                                                                                                    SHA1:787B3A9A7589F367312A8C68A4DF993AB9B7E2C6
                                                                                                                                                                    SHA-256:7107F8642186AB716BAA1501BEF1ADB8248227787F9C0B081BE22E4CFB3BD492
                                                                                                                                                                    SHA-512:45554816D58C8F0D27D92EC731979F3EDE370D50A76A86A018DAE7B5463C36EF7D663DCFF0D2B123B1377B53B64EA1CA041D601B26590A7925F1984D8B415445
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Yara Hits:
                                                                                                                                                                    • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Windows\Temp\~DF31A1C5F44E3BDC22.TMP, Author: Joe Security
                                                                                                                                                                    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Windows\Temp\~DF3ACDD70DD54C3FFA.TMP

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):20480
                                                                                                                                                                    Entropy (8bit):1.8047535349712238
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:F8PhMuRc06WXzuFT5R9UBhqcq56Adu7SiGU4dFGeKeaahIyYCfntoNr2Adu7SIDB:ohM1zFTC8p6fudFG5ahIwP
                                                                                                                                                                    MD5:D448B0565DB456E6DCDFF65DBB5C2E2B
                                                                                                                                                                    SHA1:787B3A9A7589F367312A8C68A4DF993AB9B7E2C6
                                                                                                                                                                    SHA-256:7107F8642186AB716BAA1501BEF1ADB8248227787F9C0B081BE22E4CFB3BD492
                                                                                                                                                                    SHA-512:45554816D58C8F0D27D92EC731979F3EDE370D50A76A86A018DAE7B5463C36EF7D663DCFF0D2B123B1377B53B64EA1CA041D601B26590A7925F1984D8B415445
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Yara Hits:
                                                                                                                                                                    • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Windows\Temp\~DF3ACDD70DD54C3FFA.TMP, Author: Joe Security
                                                                                                                                                                    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Windows\Temp\~DF5429B9B17B4B71FC.TMP

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):69632
                                                                                                                                                                    Entropy (8bit):0.23594069254870706
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:vDDBAdu7S3qcq56Adu7SiGU4dFGeKeaahIyYCfntoNrY/9U:hxp6fudFG5ahIwR
                                                                                                                                                                    MD5:308E981274F1B1497845DCDD5EDC64EB
                                                                                                                                                                    SHA1:D5B892BEE501965A47E673D0109CC451D79D5177
                                                                                                                                                                    SHA-256:10D46D5A662AA9C470C8DF40B22B0BF8B2D917353FACADAAB7D8EC402094F7AD
                                                                                                                                                                    SHA-512:B9F4D081517989BA21BCD390FB587BB5DD735B146352E5896855E130D38CD8C089D7440B30EF6DCBB9B8C87D12DB1906BC96CB48DC5199E7282612BBE58F801A
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Yara Hits:
                                                                                                                                                                    • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Windows\Temp\~DF5429B9B17B4B71FC.TMP, Author: Joe Security
                                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Windows\Temp\~DF585FEE7EF8A954A7.TMP

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):512
                                                                                                                                                                    Entropy (8bit):0.0
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3::
                                                                                                                                                                    MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                                    SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                                    SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                                    SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Windows\Temp\~DFA94F270059EFE959.TMP

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):512
                                                                                                                                                                    Entropy (8bit):0.0
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3::
                                                                                                                                                                    MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                                    SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                                    SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                                    SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Windows\Temp\~DFB37894D51001CBDC.TMP

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):512
                                                                                                                                                                    Entropy (8bit):0.0
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3::
                                                                                                                                                                    MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                                    SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                                    SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                                    SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Windows\Temp\~DFCAA19AAB68B3C67C.TMP

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):32768
                                                                                                                                                                    Entropy (8bit):0.07739083401354742
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:2/9LG7iVCnLG7iVrKOzPLHKOQPhNrFdoEh0PnVSKChiVky6l51:2F0i8n0itFzDHFalHiPnw7r
                                                                                                                                                                    MD5:A72C608F1AC83D045BCCC28290D9BA0B
                                                                                                                                                                    SHA1:4F42DF074BB1863C0278F6CD74D537F2EFD3DBAF
                                                                                                                                                                    SHA-256:4150C7A8C2D24BEC061E1047EA0647C94935E6D4828EE80721C0E472E7FE132D
                                                                                                                                                                    SHA-512:8BD0C0883EDEAD19FC040C5C8DC53686D49843ECDCD26FDD7E42921C009CB605DCE7B6D3AB6C4B6DC9FA78CF449F79B73AF12B4FE6BBE7CF2DAE460DDD15A83B
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Windows\Temp\~DFDC109B3E936D4CFB.TMP

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):32768
                                                                                                                                                                    Entropy (8bit):1.4238943318896713
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:mpkuwth8FXzvT5aUJ9UBhqcq56Adu7SiGU4dFGeKeaahIyYCfntoNr2Adu7SIDB:GkSRTot8p6fudFG5ahIwP
                                                                                                                                                                    MD5:261B76AEA8EB8800835B06BD8453A938
                                                                                                                                                                    SHA1:951846A1A9D4461C9A9B348576AC3F48B141BD02
                                                                                                                                                                    SHA-256:CF2D7E509DC1BAF97E3E26396E47737872C21A573B4D46F1CEC5DD1BF2078CE1
                                                                                                                                                                    SHA-512:66EC61B16587FFE748116D4504C4A700F2E5504F4E1B6CFC3B8B6CC6F7B5329C374C7903CC0DB13DB5325B656876FFBC33ED4FD095B57E46D58C1C8E4DBF819D
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Yara Hits:
                                                                                                                                                                    • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Windows\Temp\~DFDC109B3E936D4CFB.TMP, Author: Joe Security
                                                                                                                                                                    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    Static File Info

                                                                                                                                                                    General

                                                                                                                                                                    File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Entropy (8bit):7.4294521087631065
                                                                                                                                                                    TrID:
                                                                                                                                                                    • Win32 Executable (generic) Net Framework (10011505/4) 50.01%
                                                                                                                                                                    • Win32 Executable (generic) a (10002005/4) 49.97%
                                                                                                                                                                    • Generic Win/DOS Executable (2004/3) 0.01%
                                                                                                                                                                    • DOS Executable Generic (2002/1) 0.01%
                                                                                                                                                                    • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                    File name:NotaFiscalOnline.ClientSetup.ex#.exe
                                                                                                                                                                    File size:5'620'152 bytes
                                                                                                                                                                    MD5:6172d1fc5570bc73675ba4dd05772a6e
                                                                                                                                                                    SHA1:407aa98fe89d23a8b0fd3b9f448ee11bcf028c41
                                                                                                                                                                    SHA256:564370d9522a479a4ed5c2a9b18f66e289e51e2dbf3ce3920fc3e0ad99e25046
                                                                                                                                                                    SHA512:c29d535b32a7dfaa6b4a9fc863dcdbdf92165c39cff5a62e1570b31874c661164e146e4c2cd50e41afc71713cf37ea7fd0beceda35e7e77954f326fc470ede8b
                                                                                                                                                                    SSDEEP:49152:kEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:tEs6efPNwJ4t1h0cG5FGJRPxow8O
                                                                                                                                                                    TLSH:DE46E111B3DA95B9D4BF063CD87A82699A74BC044712C7EF53D4BD2D2D32BC05A323A6
                                                                                                                                                                    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_..E>`.E>`.E>`.....O>`.....?>`.....]>`..Ee.`>`..Ed.T>`..Ec.Q>`.LF..A>`.[l..F>`.E>a.%>`..Ei.D>`..E..D>`..Eb.D>`.RichE>`........

                                                                                                                                                                    File Icon

                                                                                                                                                                    Icon Hash:90cececece8e8eb0

                                                                                                                                                                    Static PE Info

                                                                                                                                                                    General

                                                                                                                                                                    Entrypoint:0x4014ad
                                                                                                                                                                    Entrypoint Section:.text
                                                                                                                                                                    Digitally signed:true
                                                                                                                                                                    Imagebase:0x400000
                                                                                                                                                                    Subsystem:windows gui
                                                                                                                                                                    Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                                                                                                    DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                                                                                                                                    Time Stamp:0x6377E6AC [Fri Nov 18 20:10:20 2022 UTC]
                                                                                                                                                                    TLS Callbacks:
                                                                                                                                                                    CLR (.Net) Version:
                                                                                                                                                                    OS Version Major:5
                                                                                                                                                                    OS Version Minor:1
                                                                                                                                                                    File Version Major:5
                                                                                                                                                                    File Version Minor:1
                                                                                                                                                                    Subsystem Version Major:5
                                                                                                                                                                    Subsystem Version Minor:1
                                                                                                                                                                    Import Hash:9771ee6344923fa220489ab01239bdfd

                                                                                                                                                                    Authenticode Signature

                                                                                                                                                                    Signature Valid:true
                                                                                                                                                                    Signature Issuer:CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
                                                                                                                                                                    Signature Validation Error:The operation completed successfully
                                                                                                                                                                    Error Number:0
                                                                                                                                                                    Not Before, Not After
                                                                                                                                                                    • 17/08/2022 01:00:00 16/08/2025 00:59:59
                                                                                                                                                                    Subject Chain
                                                                                                                                                                    • CN="Connectwise, LLC", O="Connectwise, LLC", L=Tampa, S=Florida, C=US
                                                                                                                                                                    Version:3
                                                                                                                                                                    Thumbprint MD5:AAE704EC2810686C3BF7704E660AFB5D
                                                                                                                                                                    Thumbprint SHA-1:4C2272FBA7A7380F55E2A424E9E624AEE1C14579
                                                                                                                                                                    Thumbprint SHA-256:82B4E7924D5BED84FB16DDF8391936EB301479CEC707DC14E23BC22B8CDEAE28
                                                                                                                                                                    Serial:0B9360051BCCF66642998998D5BA97CE

                                                                                                                                                                    Entrypoint Preview

                                                                                                                                                                    Instruction
                                                                                                                                                                    call 00007F91746B96BAh
                                                                                                                                                                    jmp 00007F91746B916Fh
                                                                                                                                                                    push ebp
                                                                                                                                                                    mov ebp, esp
                                                                                                                                                                    push 00000000h
                                                                                                                                                                    call dword ptr [0040D040h]
                                                                                                                                                                    push dword ptr [ebp+08h]
                                                                                                                                                                    call dword ptr [0040D03Ch]
                                                                                                                                                                    push C0000409h
                                                                                                                                                                    call dword ptr [0040D044h]
                                                                                                                                                                    push eax
                                                                                                                                                                    call dword ptr [0040D048h]
                                                                                                                                                                    pop ebp
                                                                                                                                                                    ret
                                                                                                                                                                    push ebp
                                                                                                                                                                    mov ebp, esp
                                                                                                                                                                    sub esp, 00000324h
                                                                                                                                                                    push 00000017h
                                                                                                                                                                    call dword ptr [0040D04Ch]
                                                                                                                                                                    test eax, eax
                                                                                                                                                                    je 00007F91746B92F7h
                                                                                                                                                                    push 00000002h
                                                                                                                                                                    pop ecx
                                                                                                                                                                    int 29h
                                                                                                                                                                    mov dword ptr [004148D8h], eax
                                                                                                                                                                    mov dword ptr [004148D4h], ecx
                                                                                                                                                                    mov dword ptr [004148D0h], edx
                                                                                                                                                                    mov dword ptr [004148CCh], ebx
                                                                                                                                                                    mov dword ptr [004148C8h], esi
                                                                                                                                                                    mov dword ptr [004148C4h], edi
                                                                                                                                                                    mov word ptr [004148F0h], ss
                                                                                                                                                                    mov word ptr [004148E4h], cs
                                                                                                                                                                    mov word ptr [004148C0h], ds
                                                                                                                                                                    mov word ptr [004148BCh], es
                                                                                                                                                                    mov word ptr [004148B8h], fs
                                                                                                                                                                    mov word ptr [004148B4h], gs
                                                                                                                                                                    pushfd
                                                                                                                                                                    pop dword ptr [004148E8h]
                                                                                                                                                                    mov eax, dword ptr [ebp+00h]
                                                                                                                                                                    mov dword ptr [004148DCh], eax
                                                                                                                                                                    mov eax, dword ptr [ebp+04h]
                                                                                                                                                                    mov dword ptr [004148E0h], eax
                                                                                                                                                                    lea eax, dword ptr [ebp+08h]
                                                                                                                                                                    mov dword ptr [004148ECh], eax
                                                                                                                                                                    mov eax, dword ptr [ebp-00000324h]
                                                                                                                                                                    mov dword ptr [00414828h], 00010001h

                                                                                                                                                                    Rich Headers

                                                                                                                                                                    Programming Language:
                                                                                                                                                                    • [IMP] VS2008 SP1 build 30729
                                                                                                                                                                    • [IMP] VS2008 build 21022

                                                                                                                                                                    Data Directories

                                                                                                                                                                    NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_IMPORT0x129c40x50.rdata
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_RESOURCE0x160000x533074.rsrc
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_SECURITY0x5462000x15fb8
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_BASERELOC0x54a0000xea8.reloc
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_DEBUG0x11f200x70.rdata
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x11e600x40.rdata
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_IAT0xd0000x13c.rdata
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                    Sections

                                                                                                                                                                    NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                    .text0x10000xb1af0xb200d9fa6da0baf4b869720be833223490cbFalse0.6123156601123596data6.592039633797327IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                    .rdata0xd0000x60780x62008b45a1035c0de72f910a75db7749f735False0.41549744897959184data4.786621464556291IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                    .data0x140000x11e40x8001f4cc86b6735a74429c9d1feb93e2871False0.18310546875data2.265083745848167IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                    .rsrc0x160000x5330740x533200d813d73373778ed5b0a4b71b252379ebunknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                    .reloc0x54a0000xea80x1000a93b0f39998e1e69e5944da8c5ff06b1False0.72265625data6.301490309336801IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                    Resources

                                                                                                                                                                    NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                    FILES0x163d40x86000PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows0.3962220149253731
                                                                                                                                                                    FILES0x9c3d40x1a4600PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows0.5111589431762695
                                                                                                                                                                    FILES0x2409d40x1ac00PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows0.4415066442757009
                                                                                                                                                                    FILES0x25b5d40x2ec318PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows0.9810924530029297
                                                                                                                                                                    FILES0x5478ec0x1600PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows0.3908025568181818
                                                                                                                                                                    RT_MANIFEST0x548eec0x188XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.5892857142857143

                                                                                                                                                                    Imports

                                                                                                                                                                    DLLImport
                                                                                                                                                                    mscoree.dllCorBindToRuntimeEx
                                                                                                                                                                    KERNEL32.dllGetModuleFileNameA, DecodePointer, SizeofResource, LockResource, LoadLibraryW, LoadResource, FindResourceW, GetProcAddress, WriteConsoleW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, FlushFileBuffers, HeapReAlloc, HeapSize, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, RtlUnwind, GetLastError, SetLastError, EncodePointer, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, RaiseException, GetStdHandle, WriteFile, CreateFileW, MultiByteToWideChar, WideCharToMultiByte, ExitProcess, GetModuleHandleExW, GetACP, CloseHandle, HeapAlloc, HeapFree, FindClose, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, LCMapStringW, SetStdHandle, GetFileType, GetStringTypeW, GetProcessHeap
                                                                                                                                                                    OLEAUT32.dllVariantInit, SafeArrayUnaccessData, SafeArrayCreateVector, SafeArrayDestroy, VariantClear, SafeArrayAccessData

                                                                                                                                                                    Possible Origin

                                                                                                                                                                    Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                    EnglishUnited States

                                                                                                                                                                    Network Behavior

                                                                                                                                                                    Network Port Distribution

                                                                                                                                                                    TCP Packets

                                                                                                                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                    Dec 20, 2024 22:33:08.427717924 CET49731443192.168.2.451.89.135.228
                                                                                                                                                                    Dec 20, 2024 22:33:08.427809000 CET4434973151.89.135.228192.168.2.4
                                                                                                                                                                    Dec 20, 2024 22:33:08.427906990 CET49731443192.168.2.451.89.135.228
                                                                                                                                                                    Dec 20, 2024 22:33:08.922317028 CET49731443192.168.2.451.89.135.228
                                                                                                                                                                    Dec 20, 2024 22:33:08.922395945 CET4434973151.89.135.228192.168.2.4
                                                                                                                                                                    Dec 20, 2024 22:33:08.922466040 CET4434973151.89.135.228192.168.2.4
                                                                                                                                                                    Dec 20, 2024 22:33:11.074383974 CET49734443192.168.2.451.89.135.228
                                                                                                                                                                    Dec 20, 2024 22:33:11.074439049 CET4434973451.89.135.228192.168.2.4
                                                                                                                                                                    Dec 20, 2024 22:33:11.074513912 CET49734443192.168.2.451.89.135.228
                                                                                                                                                                    Dec 20, 2024 22:33:11.079884052 CET49734443192.168.2.451.89.135.228
                                                                                                                                                                    Dec 20, 2024 22:33:11.079922915 CET4434973451.89.135.228192.168.2.4
                                                                                                                                                                    Dec 20, 2024 22:33:11.079962969 CET4434973451.89.135.228192.168.2.4
                                                                                                                                                                    Dec 20, 2024 22:33:13.553599119 CET49736443192.168.2.451.89.135.228
                                                                                                                                                                    Dec 20, 2024 22:33:13.553714037 CET4434973651.89.135.228192.168.2.4
                                                                                                                                                                    Dec 20, 2024 22:33:13.553792953 CET49736443192.168.2.451.89.135.228
                                                                                                                                                                    Dec 20, 2024 22:33:13.556118011 CET49736443192.168.2.451.89.135.228
                                                                                                                                                                    Dec 20, 2024 22:33:13.556155920 CET4434973651.89.135.228192.168.2.4
                                                                                                                                                                    Dec 20, 2024 22:33:13.556201935 CET4434973651.89.135.228192.168.2.4
                                                                                                                                                                    Dec 20, 2024 22:33:17.061749935 CET49739443192.168.2.451.89.135.228
                                                                                                                                                                    Dec 20, 2024 22:33:17.061810017 CET4434973951.89.135.228192.168.2.4
                                                                                                                                                                    Dec 20, 2024 22:33:17.061889887 CET49739443192.168.2.451.89.135.228
                                                                                                                                                                    Dec 20, 2024 22:33:17.065568924 CET49739443192.168.2.451.89.135.228
                                                                                                                                                                    Dec 20, 2024 22:33:17.065596104 CET4434973951.89.135.228192.168.2.4
                                                                                                                                                                    Dec 20, 2024 22:33:17.065659046 CET4434973951.89.135.228192.168.2.4
                                                                                                                                                                    Dec 20, 2024 22:33:21.669272900 CET49742443192.168.2.451.89.135.228
                                                                                                                                                                    Dec 20, 2024 22:33:21.669327021 CET4434974251.89.135.228192.168.2.4
                                                                                                                                                                    Dec 20, 2024 22:33:21.669960022 CET49742443192.168.2.451.89.135.228
                                                                                                                                                                    Dec 20, 2024 22:33:21.672497034 CET49742443192.168.2.451.89.135.228
                                                                                                                                                                    Dec 20, 2024 22:33:21.672518015 CET4434974251.89.135.228192.168.2.4
                                                                                                                                                                    Dec 20, 2024 22:33:21.672571898 CET4434974251.89.135.228192.168.2.4
                                                                                                                                                                    Dec 20, 2024 22:33:29.630604982 CET49747443192.168.2.451.89.135.228
                                                                                                                                                                    Dec 20, 2024 22:33:29.630703926 CET4434974751.89.135.228192.168.2.4
                                                                                                                                                                    Dec 20, 2024 22:33:29.630855083 CET49747443192.168.2.451.89.135.228
                                                                                                                                                                    Dec 20, 2024 22:33:29.634160042 CET49747443192.168.2.451.89.135.228
                                                                                                                                                                    Dec 20, 2024 22:33:29.634196043 CET4434974751.89.135.228192.168.2.4
                                                                                                                                                                    Dec 20, 2024 22:33:29.634248018 CET4434974751.89.135.228192.168.2.4
                                                                                                                                                                    Dec 20, 2024 22:33:43.048569918 CET49748443192.168.2.451.89.135.228
                                                                                                                                                                    Dec 20, 2024 22:33:43.048669100 CET4434974851.89.135.228192.168.2.4
                                                                                                                                                                    Dec 20, 2024 22:33:43.048759937 CET49748443192.168.2.451.89.135.228
                                                                                                                                                                    Dec 20, 2024 22:33:43.051563025 CET49748443192.168.2.451.89.135.228
                                                                                                                                                                    Dec 20, 2024 22:33:43.051595926 CET4434974851.89.135.228192.168.2.4
                                                                                                                                                                    Dec 20, 2024 22:33:43.051656961 CET4434974851.89.135.228192.168.2.4
                                                                                                                                                                    Dec 20, 2024 22:34:04.356384993 CET49761443192.168.2.451.89.135.228
                                                                                                                                                                    Dec 20, 2024 22:34:04.356489897 CET4434976151.89.135.228192.168.2.4
                                                                                                                                                                    Dec 20, 2024 22:34:04.356579065 CET49761443192.168.2.451.89.135.228
                                                                                                                                                                    Dec 20, 2024 22:34:04.359263897 CET49761443192.168.2.451.89.135.228
                                                                                                                                                                    Dec 20, 2024 22:34:04.359296083 CET4434976151.89.135.228192.168.2.4
                                                                                                                                                                    Dec 20, 2024 22:34:04.359349966 CET4434976151.89.135.228192.168.2.4
                                                                                                                                                                    Dec 20, 2024 22:34:40.684345007 CET49840443192.168.2.451.89.135.228
                                                                                                                                                                    Dec 20, 2024 22:34:40.684402943 CET4434984051.89.135.228192.168.2.4
                                                                                                                                                                    Dec 20, 2024 22:34:40.684497118 CET49840443192.168.2.451.89.135.228
                                                                                                                                                                    Dec 20, 2024 22:34:40.687016010 CET49840443192.168.2.451.89.135.228
                                                                                                                                                                    Dec 20, 2024 22:34:40.687040091 CET4434984051.89.135.228192.168.2.4
                                                                                                                                                                    Dec 20, 2024 22:34:40.687096119 CET4434984051.89.135.228192.168.2.4

                                                                                                                                                                    UDP Packets

                                                                                                                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                    Dec 20, 2024 22:33:08.115094900 CET5708853192.168.2.41.1.1.1
                                                                                                                                                                    Dec 20, 2024 22:33:08.397314072 CET53570881.1.1.1192.168.2.4
                                                                                                                                                                    Dec 20, 2024 22:33:42.642411947 CET6260253192.168.2.41.1.1.1
                                                                                                                                                                    Dec 20, 2024 22:33:43.036406994 CET53626021.1.1.1192.168.2.4
                                                                                                                                                                    Dec 20, 2024 22:34:40.359864950 CET6234853192.168.2.41.1.1.1
                                                                                                                                                                    Dec 20, 2024 22:34:40.672940016 CET53623481.1.1.1192.168.2.4

                                                                                                                                                                    DNS Queries

                                                                                                                                                                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                    Dec 20, 2024 22:33:08.115094900 CET192.168.2.41.1.1.10xfa20Standard query (0)instance-moi41i-relay.screenconnect.comA (IP address)IN (0x0001)false
                                                                                                                                                                    Dec 20, 2024 22:33:42.642411947 CET192.168.2.41.1.1.10x766eStandard query (0)instance-moi41i-relay.screenconnect.comA (IP address)IN (0x0001)false
                                                                                                                                                                    Dec 20, 2024 22:34:40.359864950 CET192.168.2.41.1.1.10x987dStandard query (0)instance-moi41i-relay.screenconnect.comA (IP address)IN (0x0001)false

                                                                                                                                                                    DNS Answers

                                                                                                                                                                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                    Dec 20, 2024 22:33:08.397314072 CET1.1.1.1192.168.2.40xfa20No error (0)instance-moi41i-relay.screenconnect.comserver-ovh31444376-relay.screenconnect.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                    Dec 20, 2024 22:33:08.397314072 CET1.1.1.1192.168.2.40xfa20No error (0)server-ovh31444376-relay.screenconnect.com51.89.135.228A (IP address)IN (0x0001)false
                                                                                                                                                                    Dec 20, 2024 22:33:43.036406994 CET1.1.1.1192.168.2.40x766eNo error (0)instance-moi41i-relay.screenconnect.comserver-ovh31444376-relay.screenconnect.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                    Dec 20, 2024 22:33:43.036406994 CET1.1.1.1192.168.2.40x766eNo error (0)server-ovh31444376-relay.screenconnect.com51.89.135.228A (IP address)IN (0x0001)false
                                                                                                                                                                    Dec 20, 2024 22:34:40.672940016 CET1.1.1.1192.168.2.40x987dNo error (0)instance-moi41i-relay.screenconnect.comserver-ovh31444376-relay.screenconnect.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                    Dec 20, 2024 22:34:40.672940016 CET1.1.1.1192.168.2.40x987dNo error (0)server-ovh31444376-relay.screenconnect.com51.89.135.228A (IP address)IN (0x0001)false

                                                                                                                                                                    Statistics

                                                                                                                                                                    CPU Usage

                                                                                                                                                                    Click to jump to process

                                                                                                                                                                    Memory Usage

                                                                                                                                                                    Click to jump to process

                                                                                                                                                                    High Level Behavior Distribution

                                                                                                                                                                    Click to dive into process behavior distribution

                                                                                                                                                                    Behavior

                                                                                                                                                                    Click to jump to process

                                                                                                                                                                    System Behavior

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:0
                                                                                                                                                                    Start time:16:33:01
                                                                                                                                                                    Start date:20/12/2024
                                                                                                                                                                    Path:C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:"C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exe"
                                                                                                                                                                    Imagebase:0x310000
                                                                                                                                                                    File size:5'620'152 bytes
                                                                                                                                                                    MD5 hash:6172D1FC5570BC73675BA4DD05772A6E
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Yara matches:
                                                                                                                                                                    • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000000.00000002.1720978268.0000000005C40000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000000.00000000.1682451497.0000000000326000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                                                                                                    Reputation:low
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:1
                                                                                                                                                                    Start time:16:33:02
                                                                                                                                                                    Start date:20/12/2024
                                                                                                                                                                    Path:C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ScreenConnect\24.3.7.9067\bc180d8c7278c2c2\ScreenConnect.ClientSetup.msi"
                                                                                                                                                                    Imagebase:0x5a0000
                                                                                                                                                                    File size:59'904 bytes
                                                                                                                                                                    MD5 hash:9D09DC1EDA745A5F87553048E57620CF
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:high
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:2
                                                                                                                                                                    Start time:16:33:02
                                                                                                                                                                    Start date:20/12/2024
                                                                                                                                                                    Path:C:\Windows\System32\msiexec.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                    Imagebase:0x7ff760a00000
                                                                                                                                                                    File size:69'632 bytes
                                                                                                                                                                    MD5 hash:E5DA170027542E25EDE42FC54C929077
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:high
                                                                                                                                                                    Has exited:false

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:3
                                                                                                                                                                    Start time:16:33:02
                                                                                                                                                                    Start date:20/12/2024
                                                                                                                                                                    Path:C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:C:\Windows\syswow64\MsiExec.exe -Embedding 01AE97C6828A00B62856E6DBA863F62A C
                                                                                                                                                                    Imagebase:0x5a0000
                                                                                                                                                                    File size:59'904 bytes
                                                                                                                                                                    MD5 hash:9D09DC1EDA745A5F87553048E57620CF
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:high
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:4
                                                                                                                                                                    Start time:16:33:03
                                                                                                                                                                    Start date:20/12/2024
                                                                                                                                                                    Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:rundll32.exe "C:\Users\user\AppData\Local\Temp\MSI2520.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_6628765 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                                                                                                                                                                    Imagebase:0xe50000
                                                                                                                                                                    File size:61'440 bytes
                                                                                                                                                                    MD5 hash:889B99C52A60DD49227C5E485A016679
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:high
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:5
                                                                                                                                                                    Start time:16:33:05
                                                                                                                                                                    Start date:20/12/2024
                                                                                                                                                                    Path:C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:C:\Windows\syswow64\MsiExec.exe -Embedding 631DC54B678986F45EC3DD437FC857A0
                                                                                                                                                                    Imagebase:0x5a0000
                                                                                                                                                                    File size:59'904 bytes
                                                                                                                                                                    MD5 hash:9D09DC1EDA745A5F87553048E57620CF
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:high
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:6
                                                                                                                                                                    Start time:16:33:05
                                                                                                                                                                    Start date:20/12/2024
                                                                                                                                                                    Path:C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:C:\Windows\syswow64\MsiExec.exe -Embedding DA995B7CADCB555D52A21FB927C287F4 E Global\MSI0000
                                                                                                                                                                    Imagebase:0x5a0000
                                                                                                                                                                    File size:59'904 bytes
                                                                                                                                                                    MD5 hash:9D09DC1EDA745A5F87553048E57620CF
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:high
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:7
                                                                                                                                                                    Start time:16:33:05
                                                                                                                                                                    Start date:20/12/2024
                                                                                                                                                                    Path:C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:"C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-moi41i-relay.screenconnect.com&p=443&s=c0ccf19a-72f4-49f1-916b-7723f411f3c8&k=BgIAAACkAABSU0ExAAgAAAEAAQCtUXkVr37HxSNSKxbtVhrTqFy7qJEmo6oCjc91wFOvR4MUBL0kG%2fPw0Y6O4Cbp7p%2bPwDDGLRq%2fNEgwH7S00d6wq1MfdBFm9Uj%2f4fypFZ638LE3OcnK3GXv9nhEoZ1FF8a9u5e0J2AODxPEA5zAmcZC%2b7QZoOfCFaWBpymeq6yYlchLnp1mxk8YwdX7eUAaEm9dE2I95SghGZoVVq0fNyXOlQyIf5EHMgY9Z1LVbVieXeSWVl3znzwAO%2f2y0TpiXGxUUGXL5LRto6Is%2bwKhhKCzwCy3hm8ZX1L10%2fafGHE8wmaJEDg1ddSksTCut%2fYCxPRx7MSQDUTkMhfPMZ4NO3HW"
                                                                                                                                                                    Imagebase:0x580000
                                                                                                                                                                    File size:95'512 bytes
                                                                                                                                                                    MD5 hash:75B21D04C69128A7230A0998086B61AA
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Antivirus matches:
                                                                                                                                                                    • Detection: 0%, ReversingLabs
                                                                                                                                                                    Reputation:moderate
                                                                                                                                                                    Has exited:false

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:8
                                                                                                                                                                    Start time:16:33:07
                                                                                                                                                                    Start date:20/12/2024
                                                                                                                                                                    Path:C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:"C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exe" "RunRole" "7287b599-81b8-4cbc-8966-5e6b6b8ab1f8" "User"
                                                                                                                                                                    Imagebase:0x950000
                                                                                                                                                                    File size:602'392 bytes
                                                                                                                                                                    MD5 hash:1778204A8C3BC2B8E5E4194EDBAF7135
                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Yara matches:
                                                                                                                                                                    • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000008.00000000.1742944760.0000000000952000.00000002.00000001.01000000.00000011.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000008.00000002.2935287983.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exe, Author: Joe Security
                                                                                                                                                                    Antivirus matches:
                                                                                                                                                                    • Detection: 0%, ReversingLabs
                                                                                                                                                                    Reputation:moderate
                                                                                                                                                                    Has exited:false

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:9
                                                                                                                                                                    Start time:16:33:09
                                                                                                                                                                    Start date:20/12/2024
                                                                                                                                                                    Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                                                    Imagebase:0x7ff6eef20000
                                                                                                                                                                    File size:55'320 bytes
                                                                                                                                                                    MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:high
                                                                                                                                                                    Has exited:false

                                                                                                                                                                    Disassembly

                                                                                                                                                                    Reset < >

                                                                                                                                                                      Execution Graph

                                                                                                                                                                      Execution Coverage:15.4%
                                                                                                                                                                      Dynamic/Decrypted Code Coverage:100%
                                                                                                                                                                      Signature Coverage:33.3%
                                                                                                                                                                      Total number of Nodes:15
                                                                                                                                                                      Total number of Limit Nodes:1
                                                                                                                                                                      execution_graph 28596 18741f0 28597 18741f1 28596->28597 28601 5b014b0 28597->28601 28605 5b014c0 28597->28605 28598 18743ed 28598->28598 28602 5b014ce 28601->28602 28603 5b014d4 28601->28603 28609 5b02d07 28602->28609 28603->28598 28606 5b014ce 28605->28606 28607 5b014d4 28605->28607 28608 5b02d07 RtlGetVersion 28606->28608 28607->28598 28608->28607 28610 5b02d23 28609->28610 28611 5b02f0c RtlGetVersion 28610->28611 28612 5b02e2c 28610->28612 28613 5b02fca 28611->28613 28612->28603 28613->28603

                                                                                                                                                                      Executed Functions

                                                                                                                                                                      Function 05B02D07 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 229COMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 98 5b02d07-5b02d22 99 5b02d23-5b02d49 98->99 101 5b02d4b-5b02de6 99->101 108 5b02e58-5b02e6d 101->108 109 5b02de8-5b02dfc 101->109 116 5b02ead-5b02ec8 108->116 117 5b02e6f-5b02e8b 108->117 112 5b02e02 109->112 113 5b02dfe-5b02e00 109->113 114 5b02e05-5b02e26 call 5b02560 112->114 113->114 124 5b02ef8-5b02fc8 RtlGetVersion 114->124 125 5b02e2c-5b02e57 114->125 123 5b02eca-5b02ece 116->123 129 5b02e95-5b02eab 117->129 130 5b02e8d 117->130 127 5b02ed0 123->127 128 5b02ed9 123->128 137 5b02fd1-5b03014 124->137 138 5b02fca-5b02fd0 124->138 127->128 128->124 129->123 130->129 142 5b03016 137->142 143 5b0301b-5b03022 137->143 138->137 142->143
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720564370.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b00000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: LRkq$`Qkq$`Qkq
                                                                                                                                                                      • API String ID: 0-3167291071
                                                                                                                                                                      • Opcode ID: bdb0465601f844b2a2c7748019c2d7638461bec9d888192e805c30d3b482f3b5
                                                                                                                                                                      • Instruction ID: 97271bff41431e9dbab432fd3a3ccc16437e994cd8499767e8c719efbc0191ac
                                                                                                                                                                      • Opcode Fuzzy Hash: bdb0465601f844b2a2c7748019c2d7638461bec9d888192e805c30d3b482f3b5
                                                                                                                                                                      • Instruction Fuzzy Hash: 6481FE34A043558FEB20AB68CC18BEABFB1FF45210F0082EAD445AB2D5DB745D49CB91
                                                                                                                                                                      Function 05B0BA20 Relevance: 6.9, Strings: 5, Instructions: 675COMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 144 5b0ba20-5b0ba55 340 5b0ba57 call 5b0ba30 144->340 341 5b0ba57 call 5b0ba20 144->341 147 5b0ba5d-5b0bad2 call 5b0b318 * 2 call 5b0a9b8 159 5b0bbb4-5b0bbbe 147->159 160 5b0bad8-5b0bada 147->160 161 5b0bae0-5b0bae6 160->161 162 5b0bbbf-5b0bc1f 160->162 163 5b0bc26-5b0bc8b 161->163 164 5b0baec-5b0bafe 161->164 162->163 188 5b0bc8c-5b0bcb0 163->188 169 5b0bb70-5b0bbae call 5b0b794 164->169 170 5b0bb00-5b0bb68 164->170 169->159 169->160 170->169 192 5b0bcb2-5b0bcc3 188->192 193 5b0bcc9-5b0bcca 188->193 192->193 193->188 194 5b0bccc-5b0bcdc 193->194 196 5b0bce4-5b0bcec 194->196 197 5b0bda0-5b0bda9 196->197 198 5b0bdb4-5b0bdbb 197->198 199 5b0bdab-5b0bdae 197->199 201 5b0bdc1-5b0be00 call 5b0b318 198->201 202 5b0bf9f-5b0bfa8 198->202 199->198 200 5b0bcf1-5b0bcfd 199->200 203 5b0bd03-5b0bd1c 200->203 204 5b0bfa9-5b0c01d 200->204 223 5b0be02-5b0be07 201->223 224 5b0be09-5b0be16 201->224 208 5b0bd93-5b0bd9d 203->208 209 5b0bd1e-5b0bd8b 203->209 232 5b0c023-5b0c042 204->232 233 5b0c1bd-5b0c1c7 204->233 208->197 209->208 226 5b0be19-5b0be56 call 5b0a9b8 223->226 224->226 236 5b0bf90-5b0bf99 226->236 237 5b0c044-5b0c0a3 call 5b0b318 232->237 238 5b0c0ab-5b0c0ba 232->238 236->202 239 5b0be5b-5b0be9a 236->239 237->238 238->233 243 5b0c0c0-5b0c0f9 238->243 255 5b0bf11-5b0bf66 239->255 256 5b0be9c-5b0bf09 239->256 243->233 257 5b0c0ff-5b0c102 243->257 255->236 271 5b0bf68-5b0bf6a 255->271 256->255 257->233 258 5b0c108-5b0c10b 257->258 260 5b0c129-5b0c13b 258->260 261 5b0c10d-5b0c111 258->261 269 5b0c1a8-5b0c1b7 260->269 270 5b0c13d-5b0c1a0 260->270 263 5b0c113-5b0c117 261->263 264 5b0c11f-5b0c123 261->264 263->264 264->260 266 5b0c1c8-5b0c21d 264->266 288 5b0c225-5b0c230 266->288 289 5b0c21f 266->289 269->233 269->243 270->269 271->236 274 5b0bf6c-5b0bf8b 271->274 274->202 283 5b0bf8d 274->283 283->236 290 5b0c232-5b0c239 288->290 291 5b0c23a-5b0c23c 288->291 289->288 290->291 292 5b0c292-5b0c2ff 291->292 293 5b0c23e-5b0c241 291->293 299 5b0c306-5b0c31c 292->299 293->292 294 5b0c243-5b0c249 293->294 296 5b0c258-5b0c25e 294->296 297 5b0c24b-5b0c250 294->297 298 5b0c264-5b0c274 296->298 296->299 297->296 304 5b0c276-5b0c27c 298->304 305 5b0c28c-5b0c291 298->305 306 5b0c38d 299->306 307 5b0c31e-5b0c32d 299->307 310 5b0c280-5b0c282 304->310 311 5b0c27e 304->311 312 5b0c377-5b0c386 306->312 313 5b0c38e-5b0c3d1 306->313 308 5b0c335-5b0c340 307->308 309 5b0c32f 307->309 314 5b0c342-5b0c349 308->314 315 5b0c34a-5b0c34c 308->315 309->308 310->305 311->305 328 5b0c3d8-5b0c41b call 5b0b7a4 call 5b0b7b4 313->328 314->315 318 5b0c389 315->318 319 5b0c34e-5b0c351 315->319 318->306 319->318 322 5b0c353-5b0c359 319->322 324 5b0c368-5b0c36e 322->324 325 5b0c35b-5b0c360 322->325 327 5b0c370-5b0c374 324->327 324->328 325->324 327->312 340->147 341->147
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720564370.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b00000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: 4'kq$4'kq$4'kq$4'kq$4'kq
                                                                                                                                                                      • API String ID: 0-2312759404
                                                                                                                                                                      • Opcode ID: 7f1c9fd001bb3d0a07ebf7d51d8c809f30b5b28a3a05585979baf99c1dbdd3e4
                                                                                                                                                                      • Instruction ID: bef893ef9b694138a77f6df1a3e8b775a9327b7ceb922d8fbbf6bea094befc2d
                                                                                                                                                                      • Opcode Fuzzy Hash: 7f1c9fd001bb3d0a07ebf7d51d8c809f30b5b28a3a05585979baf99c1dbdd3e4
                                                                                                                                                                      • Instruction Fuzzy Hash: 4A429330A006058FCB14DFA9D484AAEFBF2FF84320F248669E5159B7A5DB34ED45CB90
                                                                                                                                                                      Function 05B087B8 Relevance: 1.9, Strings: 1, Instructions: 695COMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 606 5b087b8-5b08803 call 5b03690 751 5b08805 call 5b04e40 606->751 752 5b08805 call 5b09430 606->752 753 5b08805 call 5b087b8 606->753 754 5b08805 call 5b087a8 606->754 610 5b0880b-5b0886d call 5b0a0d1 758 5b0886f call 5b0f455 610->758 759 5b0886f call 5b0f53e 610->759 616 5b08875-5b088df 748 5b088e1 call 5b22c90 616->748 749 5b088e1 call 5b22c81 616->749 622 5b088e7-5b0892b 755 5b0892d call 5b22c90 622->755 756 5b0892d call 5b22c81 622->756 626 5b08933-5b089d4 633 5b09425-5b094c5 call 5b04e40 call 5b09b38 626->633 634 5b089da-5b08a0f 626->634 653 5b094cb-5b09514 633->653 634->633 637 5b08a15-5b08a4a 634->637 637->633 641 5b08a50-5b08a85 637->641 641->633 644 5b08a8b-5b08ac0 641->644 644->633 647 5b08ac6-5b08afb 644->647 647->633 652 5b08b01-5b08b1c 647->652 655 5b08b22-5b08b4e 652->655 656 5b08bab-5b08bbe 652->656 663 5b08b50-5b08b94 655->663 664 5b08b9c-5b08ba5 655->664 658 5b08bc0-5b08bd5 656->658 659 5b08bd7-5b08be6 656->659 660 5b08bec-5b08c13 call 5b249ea 658->660 659->660 667 5b08c15-5b08c8c 660->667 668 5b08c8e-5b08cab 660->668 663->664 664->655 664->656 667->668 674 5b08cad-5b08cc2 667->674 670 5b08cc8-5b09013 668->670 719 5b09019-5b09191 670->719 720 5b091ad-5b091c9 670->720 674->670 746 5b09193 call 5b24c90 719->746 747 5b09193 call 5b24c50 719->747 722 5b091d7 720->722 723 5b091cb 720->723 722->633 723->722 744 5b09199-5b091a7 744->719 744->720 746->744 747->744 748->622 749->622 751->610 752->610 753->610 754->610 755->626 756->626 758->616 759->616
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720564370.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b00000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 0-3916222277
                                                                                                                                                                      • Opcode ID: f8d2aa2133da9069cf6a9d500c613de56398d3980645857dd0efc877abc6692a
                                                                                                                                                                      • Instruction ID: a1f8b064a7a595acc7d0343dd74d47a7986cd724ef0c9bc48b63319acfd6d377
                                                                                                                                                                      • Opcode Fuzzy Hash: f8d2aa2133da9069cf6a9d500c613de56398d3980645857dd0efc877abc6692a
                                                                                                                                                                      • Instruction Fuzzy Hash: 24624934A00319CFCB159F68D858B9DBBB6FF89310F1085A9E909A7354DB35AD86CF90
                                                                                                                                                                      Function 05B087A8 Relevance: 1.9, Strings: 1, Instructions: 616COMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 761 5b087a8-5b08803 call 5b03690 910 5b08805 call 5b04e40 761->910 911 5b08805 call 5b09430 761->911 912 5b08805 call 5b087b8 761->912 913 5b08805 call 5b087a8 761->913 765 5b0880b-5b0886d call 5b0a0d1 902 5b0886f call 5b0f455 765->902 903 5b0886f call 5b0f53e 765->903 771 5b08875-5b088df 907 5b088e1 call 5b22c90 771->907 908 5b088e1 call 5b22c81 771->908 777 5b088e7-5b0892b 914 5b0892d call 5b22c90 777->914 915 5b0892d call 5b22c81 777->915 781 5b08933-5b089d4 788 5b09425-5b094c5 call 5b04e40 call 5b09b38 781->788 789 5b089da-5b08a0f 781->789 808 5b094cb-5b09514 788->808 789->788 792 5b08a15-5b08a4a 789->792 792->788 796 5b08a50-5b08a85 792->796 796->788 799 5b08a8b-5b08ac0 796->799 799->788 802 5b08ac6-5b08afb 799->802 802->788 807 5b08b01-5b08b1c 802->807 810 5b08b22-5b08b4e 807->810 811 5b08bab-5b08bbe 807->811 818 5b08b50-5b08b94 810->818 819 5b08b9c-5b08ba5 810->819 813 5b08bc0-5b08bd5 811->813 814 5b08bd7-5b08be6 811->814 815 5b08bec-5b08c13 call 5b249ea 813->815 814->815 822 5b08c15-5b08c8c 815->822 823 5b08c8e-5b08cab 815->823 818->819 819->810 819->811 822->823 829 5b08cad-5b08cc2 822->829 825 5b08cc8-5b09013 823->825 874 5b09019-5b09191 825->874 875 5b091ad-5b091c9 825->875 829->825 905 5b09193 call 5b24c90 874->905 906 5b09193 call 5b24c50 874->906 877 5b091d7 875->877 878 5b091cb 875->878 877->788 878->877 899 5b09199-5b091a7 899->874 899->875 902->771 903->771 905->899 906->899 907->777 908->777 910->765 911->765 912->765 913->765 914->781 915->781
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720564370.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b00000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 0-3916222277
                                                                                                                                                                      • Opcode ID: 98b318a5e31bd96cee9c304820ba229fe43224812aab92201174d37bd810eee0
                                                                                                                                                                      • Instruction ID: 078bbdae1328a5c9a30f525cff408ebcf7352d4673bcde2f02841b9953ea1802
                                                                                                                                                                      • Opcode Fuzzy Hash: 98b318a5e31bd96cee9c304820ba229fe43224812aab92201174d37bd810eee0
                                                                                                                                                                      • Instruction Fuzzy Hash: CE424A34A00318CFCB159F68D958B9DBBB6FF89310F108599E909A7394CB75AD86CF90
                                                                                                                                                                      Function 05B20CB8 Relevance: 1.3, Instructions: 1277COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: d9885a53cf8f72eb80e3aa653b480b544aed65f59f7191ff30ed95a790fea870
                                                                                                                                                                      • Instruction ID: e4639db4fb358466a2f816fa28504eae1a3cf54539cb34eb9bbfe256123840e8
                                                                                                                                                                      • Opcode Fuzzy Hash: d9885a53cf8f72eb80e3aa653b480b544aed65f59f7191ff30ed95a790fea870
                                                                                                                                                                      • Instruction Fuzzy Hash: 7DC20C74A00219DFDB14DF68C894AADBBB2FF88310F158199E959AB3A5D730ED41CF60
                                                                                                                                                                      Function 05B20698 Relevance: 10.4, Strings: 8, Instructions: 371COMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 0 5b20698-5b206bf 2 5b206c1-5b206e8 0->2 3 5b206eb-5b206f7 0->3 6 5b20724-5b20730 3->6 7 5b206f9-5b20721 3->7 11 5b20732-5b20744 6->11 12 5b2076d-5b20779 6->12 16 5b20753-5b20759 11->16 17 5b20746-5b2074b 11->17 18 5b207f6-5b20809 12->18 19 5b2077b-5b207f3 12->19 20 5b20810-5b20872 16->20 21 5b2075f-5b2076a 16->21 17->16 18->20 29 5b20891-5b2089d 20->29 30 5b20874-5b2088e 20->30 34 5b208c0-5b208cc 29->34 35 5b2089f-5b208bd 29->35 39 5b208d2-5b208d7 34->39 40 5b209d5-5b209e1 34->40 41 5b208f5 39->41 42 5b208d9-5b208df 39->42 49 5b209e3-5b209e9 40->49 50 5b20a21-5b20a6c 40->50 46 5b208f7-5b2090f 41->46 44 5b208e1-5b208e3 42->44 45 5b208e5-5b208f1 42->45 48 5b208f3 44->48 45->48 56 5b20915-5b2091e 46->56 57 5b209bf-5b209d2 46->57 48->46 53 5b209f7-5b20a1e 49->53 54 5b209eb-5b209ed 49->54 74 5b20a74-5b20a8c 50->74 75 5b20a6e 50->75 54->53 62 5b20920-5b20926 56->62 63 5b2093c 56->63 66 5b20928-5b2092a 62->66 67 5b2092c-5b20938 62->67 64 5b2093e-5b20960 63->64 93 5b20962 call 5b20698 64->93 94 5b20962 call 5b20688 64->94 95 5b20962 call 5b20848 64->95 68 5b2093a 66->68 67->68 68->64 96 5b20a8e call 5b20ab7 74->96 97 5b20a8e call 5b20ac8 74->97 76 5b20a70-5b20a72 75->76 77 5b20a99-5b20ab4 75->77 76->74 76->77 78 5b20968-5b20979 90 5b2097b call 5b20698 78->90 91 5b2097b call 5b20688 78->91 92 5b2097b call 5b20848 78->92 82 5b20a94-5b20a98 83 5b20981-5b2099a 85 5b209b4-5b209b8 83->85 86 5b2099c-5b209a2 83->86 85->57 87 5b209a6-5b209b2 86->87 88 5b209a4 86->88 87->85 88->85 90->83 91->83 92->83 93->78 94->78 95->78 96->82 97->82
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: $kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq
                                                                                                                                                                      • API String ID: 0-1078448309
                                                                                                                                                                      • Opcode ID: 9ef57e68ac502aed0d4150040f2e1817a72fcbd5529263024bd6a36caf24550b
                                                                                                                                                                      • Instruction ID: e0318deae55085a7587619303523f7b71417c32483da38c7018a3cc7b6133e6d
                                                                                                                                                                      • Opcode Fuzzy Hash: 9ef57e68ac502aed0d4150040f2e1817a72fcbd5529263024bd6a36caf24550b
                                                                                                                                                                      • Instruction Fuzzy Hash: 70C14C71B002198FCB25EF78D8545AEBBB3FF89320B20856AD509DB351DB35E941C7A1
                                                                                                                                                                      Function 01877A30 Relevance: 3.9, Strings: 3, Instructions: 191COMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 342 1877a30-1877a32 343 1877a34-1877a38 342->343 344 1877a39-1877a3a 342->344 343->344 345 1877a41-1877a7f 344->345 346 1877a3c-1877a3f 344->346 351 1877a81-1877a95 345->351 352 1877abd-1877ad5 345->352 346->345 357 1877a97 351->357 358 1877a9e-1877abb 351->358 355 1877ad7-1877aeb 352->355 356 1877b13-1877b2b 352->356 362 1877af4-1877b11 355->362 363 1877aed 355->363 364 1877b2d-1877b41 356->364 365 1877b69-1877b8e 356->365 357->358 358->352 362->356 363->362 370 1877b43 364->370 371 1877b4a-1877b67 364->371 375 1877b90-1877ba4 365->375 376 1877bcc-1877c05 365->376 370->371 371->365 380 1877ba6 375->380 381 1877bad-1877bca 375->381 387 1877c07-1877c1b 376->387 388 1877c43-1877c7c 376->388 380->381 381->376 391 1877c24-1877c41 387->391 392 1877c1d 387->392 398 1877c7e-1877c92 388->398 399 1877cba-1877cc9 388->399 391->388 392->391 402 1877c94 398->402 403 1877c9b-1877cb8 398->403 402->403 403->399
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: #!$K6$7
                                                                                                                                                                      • API String ID: 0-185628103
                                                                                                                                                                      • Opcode ID: 018151488148a4d9501c2860bc1a1d01c346cd8f0159c05f2db6a5518000434d
                                                                                                                                                                      • Instruction ID: 6b31f897d47b7e753dfb7c6474beb8bc8cbb61c210effe4b95f8369a9af296ce
                                                                                                                                                                      • Opcode Fuzzy Hash: 018151488148a4d9501c2860bc1a1d01c346cd8f0159c05f2db6a5518000434d
                                                                                                                                                                      • Instruction Fuzzy Hash: 1061A4303102014FC705AA6CE59856EBBEBEBC93613548269D91ACB359EF78DD49CBC4
                                                                                                                                                                      Function 05B22C90 Relevance: 2.8, Strings: 2, Instructions: 348COMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 406 5b22c90-5b22cf8 410 5b22d61-5b22d67 406->410 411 5b22cfa 406->411 493 5b22d6a call 5b22c90 410->493 494 5b22d6a call 5b22c81 410->494 412 5b22cfd-5b22d03 411->412 414 5b22d89-5b22de8 412->414 415 5b22d09-5b22d13 412->415 413 5b22d70-5b22d86 call 5b22820 428 5b22e1a-5b22e1f call 5b0ff60 414->428 429 5b22dea-5b22df9 414->429 415->414 417 5b22d15-5b22d1c call 5b20848 415->417 421 5b22d21-5b22d5f 417->421 421->410 421->412 431 5b22e25-5b22e47 428->431 432 5b22ed6-5b22ee0 429->432 433 5b22dff-5b22e0a 429->433 437 5b22ec9-5b22ed3 431->437 438 5b22e4d 431->438 439 5b22ee2 432->439 440 5b22ee3-5b22eff 432->440 433->432 434 5b22e10-5b22e18 433->434 434->428 434->429 441 5b22e50-5b22e66 438->441 439->440 442 5b22fb0-5b22fd5 440->442 443 5b22f05-5b22f07 440->443 450 5b22e68-5b22e6d 441->450 451 5b22e6f 441->451 445 5b22fdc-5b22fe0 442->445 443->445 446 5b22f0d-5b22f11 443->446 448 5b22fe2-5b22fe8 445->448 449 5b22fea 445->449 446->445 452 5b22f17-5b22f1f 446->452 456 5b22ff0-5b2301c 448->456 449->456 453 5b22e74-5b22e7a 450->453 451->453 454 5b23023-5b2307b 452->454 455 5b22f25-5b22f27 452->455 457 5b22eb2-5b22ec7 453->457 458 5b22e7c 453->458 488 5b23083 454->488 489 5b2307d 454->489 459 5b22f37-5b22f3b 455->459 460 5b22f29-5b22f31 455->460 456->454 457->437 457->441 463 5b22e7f-5b22e85 458->463 464 5b22fa9-5b22fad 459->464 465 5b22f3d-5b22f41 459->465 460->454 460->459 463->432 467 5b22e87-5b22eb0 463->467 468 5b22f43-5b22f57 465->468 469 5b22f59-5b22f6d 465->469 467->457 467->463 468->469 477 5b22f76-5b22f78 468->477 469->477 478 5b22f6f-5b22f73 469->478 480 5b22f91-5b22fa1 477->480 481 5b22f7a-5b22f8e 477->481 490 5b22fa3 call 5b23198 480->490 491 5b22fa3 call 5b23189 480->491 489->488 490->464 491->464 493->413 494->413
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: (oq$Hoq
                                                                                                                                                                      • API String ID: 0-3084834809
                                                                                                                                                                      • Opcode ID: f7967abdf87337c4be133f26c96754737a95eda63cd32a84cb688eb2ed2b722e
                                                                                                                                                                      • Instruction ID: 0677af48becf9bbd763d0ce0befdde9ec87391b88575271b057694f4d3938978
                                                                                                                                                                      • Opcode Fuzzy Hash: f7967abdf87337c4be133f26c96754737a95eda63cd32a84cb688eb2ed2b722e
                                                                                                                                                                      • Instruction Fuzzy Hash: 10D18075A042199FCB05DFA9C8449AEFBB6FF88310F158069E809EB254DB34ED41CBA1
                                                                                                                                                                      Function 0187D531 Relevance: 2.6, Strings: 2, Instructions: 113COMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 495 187d531-187d558 496 187d635-187d65a 495->496 497 187d55e-187d560 495->497 499 187d661-187d665 496->499 498 187d566-187d56a 497->498 497->499 498->499 501 187d570-187d578 498->501 502 187d667-187d66d 499->502 503 187d66f 499->503 507 187d57e-187d582 501->507 508 187d6a8-187d6f4 501->508 505 187d675-187d6a1 502->505 503->505 505->508 509 187d62b-187d632 507->509 510 187d588-187d58c 507->510 538 187d6fc-187d701 508->538 514 187d5b1-187d5c5 510->514 515 187d58e-187d596 510->515 523 187d5c7-187d5ce 514->523 524 187d5d1-187d5e2 514->524 517 187d5a4 515->517 518 187d598-187d59a 515->518 541 187d5a6 call 187d505 517->541 542 187d5a6 call 187d531 517->542 543 187d5a6 call 187d6e0 517->543 544 187d5a6 call 187d6f0 517->544 518->517 522 187d5ac-187d5af 522->514 522->524 525 187d5e4-187d5f0 524->525 526 187d5f2 524->526 529 187d5f4-187d603 525->529 526->529 533 187d605-187d611 529->533 534 187d613 529->534 536 187d616-187d628 533->536 534->536 539 187d629 call 187dac8 536->539 540 187d629 call 187dad8 536->540 539->509 540->509 541->522 542->522 543->522 544->522
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: (oq$Hoq
                                                                                                                                                                      • API String ID: 0-3084834809
                                                                                                                                                                      • Opcode ID: f84fc7b632f672b50691e72dfe2d11f03444907eb9d1a01442f38f9ca5667b9e
                                                                                                                                                                      • Instruction ID: ffbb3df7680f611d510a973701aea7b1278875a0b8cbb9bfe855627dfcb29828
                                                                                                                                                                      • Opcode Fuzzy Hash: f84fc7b632f672b50691e72dfe2d11f03444907eb9d1a01442f38f9ca5667b9e
                                                                                                                                                                      • Instruction Fuzzy Hash: F031CE307042498BCB45EE6D885476E7FA6BF85354F144669E909CB388DF38DE008BE2
                                                                                                                                                                      Function 05B24C90 Relevance: 2.6, Strings: 2, Instructions: 105COMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 545 5b24c90-5b24c9b 547 5b24cc8-5b24cf3 545->547 548 5b24c9d-5b24ca0 545->548 550 5b24cfa-5b24d25 547->550 549 5b24ca2-5b24caa 548->549 548->550 552 5b24cb0-5b24cc7 549->552 553 5b24d2c-5b24dc2 call 5b251d8 call 5b26451 call 5b22820 549->553 550->553 576 5b24dc7-5b24dcb 553->576
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: Tekq$Tekq
                                                                                                                                                                      • API String ID: 0-2269808460
                                                                                                                                                                      • Opcode ID: 557b247aba5dd5ce1636ee02c8fc694026941128a22f53cd7875f21a23e19dca
                                                                                                                                                                      • Instruction ID: f127e5838c2b6355deb2adc50d0099e8d74c6acdb78138abcf8013d3dbc7b63c
                                                                                                                                                                      • Opcode Fuzzy Hash: 557b247aba5dd5ce1636ee02c8fc694026941128a22f53cd7875f21a23e19dca
                                                                                                                                                                      • Instruction Fuzzy Hash: A53101313042544FCB45AFBD845881EBF96AF9236032440A9D10ECF3D6CE25ED0283A5
                                                                                                                                                                      Function 05B28935 Relevance: 1.8, Strings: 1, Instructions: 551COMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 916 5b28935-5b28d6a call 5b28914 930 5b28d6c call 5b28e10 916->930 931 5b28d6c call 5b28e00 916->931 922 5b28d72-5b28db0 927 5b28db2 922->927 928 5b28dbb 922->928 927->928 929 5b28dbc 928->929 929->929 930->922 931->922
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: Tekq
                                                                                                                                                                      • API String ID: 0-2319236580
                                                                                                                                                                      • Opcode ID: 4189f7ecac41f9af5a1f5d3aba80462d68686b35174bcedddd9ff192446d7cbe
                                                                                                                                                                      • Instruction ID: 811bddb5e99a40feb6171589cf7e309e383e1bdbd37e07d874d0cf0d978aa6e6
                                                                                                                                                                      • Opcode Fuzzy Hash: 4189f7ecac41f9af5a1f5d3aba80462d68686b35174bcedddd9ff192446d7cbe
                                                                                                                                                                      • Instruction Fuzzy Hash: 17119775A052508FCB05DB28C4696997BF2BF49300F2500AAE006EB3A2CB31AC06CBA1
                                                                                                                                                                      Function 05B251D8 Relevance: 1.5, Strings: 1, Instructions: 290COMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 932 5b251d8-5b2521f 935 5b25225-5b25267 932->935 936 5b254f8-5b2551c 932->936 945 5b25269-5b2526c 935->945 946 5b2529d-5b252be 935->946 943 5b25523-5b25586 936->943 948 5b2526f-5b25278 945->948 952 5b25371-5b2537b 946->952 953 5b252c4-5b252cd 946->953 948->943 951 5b2527e-5b2529b 948->951 951->946 951->948 957 5b254f0-5b254f7 952->957 958 5b25381-5b2538a 952->958 953->943 956 5b252d3-5b252f9 953->956 969 5b25308-5b25315 956->969 958->943 959 5b25390-5b253b9 958->959 959->943 966 5b253bf-5b253e3 959->966 966->943 972 5b253e9-5b253f5 966->972 973 5b25317-5b25320 969->973 974 5b252fb-5b25302 969->974 975 5b254e0-5b254ea 972->975 976 5b253fb-5b25405 972->976 973->943 977 5b25326-5b25343 973->977 974->969 975->957 975->958 976->943 978 5b2540b-5b25427 976->978 977->943 981 5b25349-5b2536b 977->981 978->943 982 5b2542d-5b25439 978->982 981->952 981->953 982->943 983 5b2543f-5b25450 982->983 983->943 985 5b25456-5b25461 983->985 987 5b2546b-5b2547b 985->987 987->943 989 5b25481-5b2548d 987->989 989->943 990 5b25493-5b254a8 989->990 990->943 991 5b254aa-5b254cb 990->991 991->943 993 5b254cd-5b254da 991->993 993->975 993->976
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: Tekq
                                                                                                                                                                      • API String ID: 0-2319236580
                                                                                                                                                                      • Opcode ID: 8ebafa655c6a62892370174d58cbe3ac7550a9265f97890c13437ec41dc45ab7
                                                                                                                                                                      • Instruction ID: c9520b4ea6572b9cf75b6676c6ae4df934b7220a94b5e2a987cdaa87defa9c41
                                                                                                                                                                      • Opcode Fuzzy Hash: 8ebafa655c6a62892370174d58cbe3ac7550a9265f97890c13437ec41dc45ab7
                                                                                                                                                                      • Instruction Fuzzy Hash: D6C13B74600225CFCB14DF58C584DAABBF2FF84304B568499E44A9F2A6DB30FD46CBA0
                                                                                                                                                                      Function 01878A98 Relevance: 1.4, Strings: 1, Instructions: 192COMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 1098 1878a98-1878ab8 1099 1878ae2-1878af1 1098->1099 1100 1878aba-1878adb 1098->1100 1101 1878af3 1099->1101 1102 1878afd-1878b0a 1099->1102 1100->1099 1101->1102 1106 1878b10-1878b1f 1102->1106 1107 1878bde-1878bf2 1102->1107 1110 1878b21 1106->1110 1111 1878b2b-1878b37 1106->1111 1108 1878bf4 1107->1108 1109 1878bfe-1878c21 1107->1109 1108->1109 1122 1878c23 1109->1122 1123 1878c2d-1878c37 1109->1123 1110->1111 1115 1878b70-1878b7f 1111->1115 1116 1878b39-1878b48 1111->1116 1119 1878b81 1115->1119 1120 1878b8b-1878bb2 1115->1120 1117 1878b54-1878b6f 1116->1117 1118 1878b4a 1116->1118 1118->1117 1119->1120 1130 1878bb4 1120->1130 1131 1878bbe-1878bdd 1120->1131 1122->1123 1143 1878c3a call 1878d99 1123->1143 1144 1878c3a call 1878da8 1123->1144 1129 1878c40-1878c42 1132 1878c44-1878c53 1129->1132 1133 1878c88-1878ca1 1129->1133 1130->1131 1135 1878c55 1132->1135 1136 1878c5f-1878c86 1132->1136 1138 1878ca3 1133->1138 1139 1878cac 1133->1139 1135->1136 1136->1132 1136->1133 1138->1139 1143->1129 1144->1129
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: (oq
                                                                                                                                                                      • API String ID: 0-3175707579
                                                                                                                                                                      • Opcode ID: 31d84fe8624e0fc307fc91814575349554c07da73fee61f6fbeb9f1b42291603
                                                                                                                                                                      • Instruction ID: 146778d1dbd2071ff38152af2d239c48dee4a31643a53ce2f8c95d31a5632620
                                                                                                                                                                      • Opcode Fuzzy Hash: 31d84fe8624e0fc307fc91814575349554c07da73fee61f6fbeb9f1b42291603
                                                                                                                                                                      • Instruction Fuzzy Hash: 9661F734B116158FCB14DF69D99896EBBB2FF8A314B108159E906EB365DB30ED01CB40
                                                                                                                                                                      Function 05B28E00 Relevance: 1.4, Strings: 1, Instructions: 176COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: 4'kq
                                                                                                                                                                      • API String ID: 0-3255046985
                                                                                                                                                                      • Opcode ID: 332d9836cd258409f0215756aa436a416fa24894d4caa43c343556df933cb0ac
                                                                                                                                                                      • Instruction ID: 4a92fefdca246b9a8c5df6c4a74853d067a6a3681742fcd2b21926e149af149d
                                                                                                                                                                      • Opcode Fuzzy Hash: 332d9836cd258409f0215756aa436a416fa24894d4caa43c343556df933cb0ac
                                                                                                                                                                      • Instruction Fuzzy Hash: 4C518130B006058FC754EB78C594B6EBBF2FF88320F6455A9E506DB7A5DB31AD418B90
                                                                                                                                                                      Function 0187D505 Relevance: 1.4, Strings: 1, Instructions: 106COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: Hoq
                                                                                                                                                                      • API String ID: 0-3049094369
                                                                                                                                                                      • Opcode ID: 2b1151b016360a5f24a4ff9cd0852c6346d4aff24f93f37927d693dd63aabc2f
                                                                                                                                                                      • Instruction ID: 689bd6d4f73d6938216aca9ae1b76fce220c1514d919fa04d311a682dec482cc
                                                                                                                                                                      • Opcode Fuzzy Hash: 2b1151b016360a5f24a4ff9cd0852c6346d4aff24f93f37927d693dd63aabc2f
                                                                                                                                                                      • Instruction Fuzzy Hash: 1B31DE34B042498FCB11DFACC494A6EBBA2FF85314F14856AE909CB365CB34DE04CBA1
                                                                                                                                                                      Function 0187B9B0 Relevance: 1.3, Strings: 1, Instructions: 97COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: {O$q^
                                                                                                                                                                      • API String ID: 0-2273154187
                                                                                                                                                                      • Opcode ID: a2a19ed9e3b2f2bde8f2308593ce854d47a39adf79a4749bce5d0c9d11517e85
                                                                                                                                                                      • Instruction ID: 340f967499e88937857fd803fdab6e8992127933f05b597f4c63cb8f388dc3c1
                                                                                                                                                                      • Opcode Fuzzy Hash: a2a19ed9e3b2f2bde8f2308593ce854d47a39adf79a4749bce5d0c9d11517e85
                                                                                                                                                                      • Instruction Fuzzy Hash: 633101313043420FC702BB7CA9A459E7BE7DBC232174481AAC919CB35AEE78DD0987D1
                                                                                                                                                                      Function 0187B9E8 Relevance: 1.3, Strings: 1, Instructions: 80COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: {O$q^
                                                                                                                                                                      • API String ID: 0-2273154187
                                                                                                                                                                      • Opcode ID: 2383beb4043172c53412d7da0917fc6b8b80c5712efeeb1bb2e6d6ef0c24cfb1
                                                                                                                                                                      • Instruction ID: a0266f197914a1aeb104a95ed4ae5892fa930ce1b73873ee63b588a228a8f670
                                                                                                                                                                      • Opcode Fuzzy Hash: 2383beb4043172c53412d7da0917fc6b8b80c5712efeeb1bb2e6d6ef0c24cfb1
                                                                                                                                                                      • Instruction Fuzzy Hash: 5021C2313102024BC705BB7CE99892FB6EBEBD57213408669DA1ACB358EE74DE0987D1
                                                                                                                                                                      Function 05B24180 Relevance: 1.3, Strings: 1, Instructions: 78COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: LRkq
                                                                                                                                                                      • API String ID: 0-1052062081
                                                                                                                                                                      • Opcode ID: dfee3e6d4ae4ed0e113b032eec317df69ec0a3c02c30b95a3575ce6722a725aa
                                                                                                                                                                      • Instruction ID: bb719c4ae1b43e940a50a3fa1a468a558603cf5a171187607dcaa34cc99b363e
                                                                                                                                                                      • Opcode Fuzzy Hash: dfee3e6d4ae4ed0e113b032eec317df69ec0a3c02c30b95a3575ce6722a725aa
                                                                                                                                                                      • Instruction Fuzzy Hash: CE219130B102199BDF18CBA5E5587AE7BB7FF88B11F208069E506A7394DF746D01CBA0
                                                                                                                                                                      Function 05B24171 Relevance: 1.3, Strings: 1, Instructions: 76COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: LRkq
                                                                                                                                                                      • API String ID: 0-1052062081
                                                                                                                                                                      • Opcode ID: 534ab8626462c147180d270f224d221fdeb4359b49c7a5f65964de900898e3e5
                                                                                                                                                                      • Instruction ID: 7c6eb3bbe4bc424a2be89bb6779fcc994fec36e39fd10be00a518a4562970879
                                                                                                                                                                      • Opcode Fuzzy Hash: 534ab8626462c147180d270f224d221fdeb4359b49c7a5f65964de900898e3e5
                                                                                                                                                                      • Instruction Fuzzy Hash: A821CE30B102189BDF18CFA5E558BAE7BB7EF88711F20806AE406B7394DB706D01CB60
                                                                                                                                                                      Function 0187D078 Relevance: 1.3, Strings: 1, Instructions: 63COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: (oq
                                                                                                                                                                      • API String ID: 0-3175707579
                                                                                                                                                                      • Opcode ID: 80c63e153c03991eaba066395e5a43387d836d7fc7ca87b214c4ad5f8457d99a
                                                                                                                                                                      • Instruction ID: 9c8c47390b21dd8967a1a3df09c27b9da617e6473d0490bb29825b79f6587798
                                                                                                                                                                      • Opcode Fuzzy Hash: 80c63e153c03991eaba066395e5a43387d836d7fc7ca87b214c4ad5f8457d99a
                                                                                                                                                                      • Instruction Fuzzy Hash: 2711B1353046048FC715DB6CD894A2ABBE2FFC8360B15825DE85AC7355DB36EC068B50
                                                                                                                                                                      Function 05B29FD0 Relevance: 1.3, Strings: 1, Instructions: 61COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: Tekq
                                                                                                                                                                      • API String ID: 0-2319236580
                                                                                                                                                                      • Opcode ID: 7cbfd0f8c7a1bbb3c66e8909fee769d117284347f62b5175dee4e13203a606b0
                                                                                                                                                                      • Instruction ID: 3f7c72cc069fadc6d5633466c8f31c348e0789ccadc00fa448423e662f008536
                                                                                                                                                                      • Opcode Fuzzy Hash: 7cbfd0f8c7a1bbb3c66e8909fee769d117284347f62b5175dee4e13203a606b0
                                                                                                                                                                      • Instruction Fuzzy Hash: D201F17270D7905FC35287288838A4A7FF59F8A611B2A40EBE545CB3E3C954AC0487AA
                                                                                                                                                                      Function 0187D088 Relevance: 1.3, Strings: 1, Instructions: 61COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: (oq
                                                                                                                                                                      • API String ID: 0-3175707579
                                                                                                                                                                      • Opcode ID: ad807c6cbf8a0393ad1d19c12590ed578de736f873b8d5cf7a8947c68ae12794
                                                                                                                                                                      • Instruction ID: fc829f5ec624a88d6bb79e8d04031b33aced14628fa26fedf83874b3165a0976
                                                                                                                                                                      • Opcode Fuzzy Hash: ad807c6cbf8a0393ad1d19c12590ed578de736f873b8d5cf7a8947c68ae12794
                                                                                                                                                                      • Instruction Fuzzy Hash: CF118F393046048FCB15DB9DD884A2ABBE7FFC83647158569E95AC7354DE32EC018B50
                                                                                                                                                                      Function 05B28D28 Relevance: 1.3, Strings: 1, Instructions: 49COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: Tekq
                                                                                                                                                                      • API String ID: 0-2319236580
                                                                                                                                                                      • Opcode ID: c75fa881283ef59871fe613ab2d5db966176829122593961141d15688c9a551b
                                                                                                                                                                      • Instruction ID: 1d49180dfe1c8cd5ed8cb5dceda323a6115a8472baacd024260df2acf16e9418
                                                                                                                                                                      • Opcode Fuzzy Hash: c75fa881283ef59871fe613ab2d5db966176829122593961141d15688c9a551b
                                                                                                                                                                      • Instruction Fuzzy Hash: EA112A346402148FCB18DB68C459A9DBBF2BF88300F2004A9E506E73A0CF75AC45CBA1
                                                                                                                                                                      Function 0187FB13 Relevance: 1.3, Strings: 1, Instructions: 38COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: Tekq
                                                                                                                                                                      • API String ID: 0-2319236580
                                                                                                                                                                      • Opcode ID: 324a828bf3618c04f2a0505b634e40d07cb14d1b828380bd8564db1437f4e4e4
                                                                                                                                                                      • Instruction ID: d3a6e828aa01085b66a48fb58488e5b67b55c23d8617e21b9ea0f5ed16ed526e
                                                                                                                                                                      • Opcode Fuzzy Hash: 324a828bf3618c04f2a0505b634e40d07cb14d1b828380bd8564db1437f4e4e4
                                                                                                                                                                      • Instruction Fuzzy Hash: 0EF054327001106BD614DA9DAC90FABFBDBEFC8760B24852AE909D7365C971DD0687A0
                                                                                                                                                                      Function 05B28090 Relevance: 1.3, Strings: 1, Instructions: 33COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: Tekq
                                                                                                                                                                      • API String ID: 0-2319236580
                                                                                                                                                                      • Opcode ID: c04ef8323cf4837f17c2fd12fe69298071e7d4838dc8106777660ae8754d76d7
                                                                                                                                                                      • Instruction ID: 61b73395296ce4c0642dbc80b4e4c0ce98baafa598fdc9835384d0a3a19b285e
                                                                                                                                                                      • Opcode Fuzzy Hash: c04ef8323cf4837f17c2fd12fe69298071e7d4838dc8106777660ae8754d76d7
                                                                                                                                                                      • Instruction Fuzzy Hash: FBF02B323011105FC714A62E985CAAEBFD6EFCD32071050B9F109C7391CE10CC0287D1
                                                                                                                                                                      Function 05B2A020 Relevance: 1.3, Strings: 1, Instructions: 31COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: Tekq
                                                                                                                                                                      • API String ID: 0-2319236580
                                                                                                                                                                      • Opcode ID: 4299ea1f02f35aa9349e995e83701d14bd34cb08d8f14fbcd807c05591d80684
                                                                                                                                                                      • Instruction ID: f3b83912dbe883417ea492694b287b892513907bd5e4f99b29146b3ecac94a19
                                                                                                                                                                      • Opcode Fuzzy Hash: 4299ea1f02f35aa9349e995e83701d14bd34cb08d8f14fbcd807c05591d80684
                                                                                                                                                                      • Instruction Fuzzy Hash: 7FE065363501105FC7549B5EE858E5ABBDAEFCCB20B214069F209CB3A1CE61EC018795
                                                                                                                                                                      Function 0187BF91 Relevance: 1.3, Strings: 1, Instructions: 16COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: PHkq
                                                                                                                                                                      • API String ID: 0-902561536
                                                                                                                                                                      • Opcode ID: 13f3b42a4651dc2b9fb5b433d91d78d1304b7edaee6901dad523419d922e80ad
                                                                                                                                                                      • Instruction ID: f2ef49f3514e0c3a8faa950e06a15bc8527f1b22cad367ab6c24dfc6c497815a
                                                                                                                                                                      • Opcode Fuzzy Hash: 13f3b42a4651dc2b9fb5b433d91d78d1304b7edaee6901dad523419d922e80ad
                                                                                                                                                                      • Instruction Fuzzy Hash: DBD05EB264034457CF245EA8A9097667B5ABB46324F680258EA268A2C6EA36D90287D0
                                                                                                                                                                      Function 05B26451 Relevance: .4, Instructions: 372COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 5a7ec8e4853c626d0885e0531804c37cf98fc9cf8fd16341e5ae79c2ce8198e8
                                                                                                                                                                      • Instruction ID: 8f20b263405f1ccfcb0d1ae4b1aa2ac5a6faad284d9d4d695c3ec29519acf5bd
                                                                                                                                                                      • Opcode Fuzzy Hash: 5a7ec8e4853c626d0885e0531804c37cf98fc9cf8fd16341e5ae79c2ce8198e8
                                                                                                                                                                      • Instruction Fuzzy Hash: 42F17074A006158FCB05DF68C584AA9BBF2FF88310B55C5A9E949DB365DB30FD41CB90
                                                                                                                                                                      Function 05B26DC0 Relevance: .3, Instructions: 330COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 6aae074a3f32219ece3887d02dbc95c4af953aad4d8e036282f71fafca93e10a
                                                                                                                                                                      • Instruction ID: 296adfe8e88e247fc59813b74328a2e6443d83db2d6d94c22bbc3de1539d8027
                                                                                                                                                                      • Opcode Fuzzy Hash: 6aae074a3f32219ece3887d02dbc95c4af953aad4d8e036282f71fafca93e10a
                                                                                                                                                                      • Instruction Fuzzy Hash: ADC1E130B046158FCB14DF68C850A6EBBF2FF84310F14C6AAE5589B295DB70ED45CBA1
                                                                                                                                                                      Function 05B21531 Relevance: .3, Instructions: 296COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 438888a7fc574ed056f1ef2962c460e9cf6c55276042a7768e3572994f89040a
                                                                                                                                                                      • Instruction ID: 266b9115c61792d4c375fd23d9596bf44b309fd9dbd7973f936863bffea10097
                                                                                                                                                                      • Opcode Fuzzy Hash: 438888a7fc574ed056f1ef2962c460e9cf6c55276042a7768e3572994f89040a
                                                                                                                                                                      • Instruction Fuzzy Hash: 57C1C074A002059FDB14DF58C884EAEB7F2FF88310F658199E919AB3A5DB34EC41CB60
                                                                                                                                                                      Function 0187DC59 Relevance: .3, Instructions: 294COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: f42897ae926ddda0d11e4c3488165fa52a3a00bc84c8d9f50cdf580f34a53a92
                                                                                                                                                                      • Instruction ID: 1919c01e9f50b3728ec8a290f8c63d6c45ec9e26967b72c879031880dda1a2a6
                                                                                                                                                                      • Opcode Fuzzy Hash: f42897ae926ddda0d11e4c3488165fa52a3a00bc84c8d9f50cdf580f34a53a92
                                                                                                                                                                      • Instruction Fuzzy Hash: C6C1F435A0060ADFCF01CFA8C9808AEBBB2FF49354B248559E915EB361D731ED55CBA1
                                                                                                                                                                      Function 018741E0 Relevance: .3, Instructions: 255COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 2999516d5de702cbc8e536ab6b279e72c4a9d8fe654b0dd1d0754e10c133b9ee
                                                                                                                                                                      • Instruction ID: 0e2685465fb49feae67fe97fde3b10559691067498dd9c94321c6955db19eafd
                                                                                                                                                                      • Opcode Fuzzy Hash: 2999516d5de702cbc8e536ab6b279e72c4a9d8fe654b0dd1d0754e10c133b9ee
                                                                                                                                                                      • Instruction Fuzzy Hash: B1A18F347002059FCB05DF69D998A6EBBF6FB88311B108529E80ADB359DF75ED06CB40
                                                                                                                                                                      Function 018741F0 Relevance: .2, Instructions: 247COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 62c1cc07e7095e13f009d83c85671c397541db7342580d870744bd77a991698c
                                                                                                                                                                      • Instruction ID: cf6b39d1be2bfc7ea6acbab6435db5829153f3dd5bf8915e660412634363f982
                                                                                                                                                                      • Opcode Fuzzy Hash: 62c1cc07e7095e13f009d83c85671c397541db7342580d870744bd77a991698c
                                                                                                                                                                      • Instruction Fuzzy Hash: 16915E34B002059FCB05DF6DD998A6EBBF6FB88311B108529E90ADB359DF75ED068B40
                                                                                                                                                                      Function 01875EE0 Relevance: .2, Instructions: 220COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: d108bce3d348c3fd5265c14c0b6e6310c659c0c8e5ccb4e7b1f9a213d771fb80
                                                                                                                                                                      • Instruction ID: d794b12b58b493c282914fec6ad27fc0a2831b269e23380bce6eb0d281b0645b
                                                                                                                                                                      • Opcode Fuzzy Hash: d108bce3d348c3fd5265c14c0b6e6310c659c0c8e5ccb4e7b1f9a213d771fb80
                                                                                                                                                                      • Instruction Fuzzy Hash: DE913A30A007198BCB15DF69D84859EBBF6EF84320B148669EC09DB359EB75ED06CF90
                                                                                                                                                                      Function 05B21C28 Relevance: .2, Instructions: 209COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 8932d0e01e717c6f4c0693f03e830746527809c436a68a4e47b9cd1bf38d6ba7
                                                                                                                                                                      • Instruction ID: 289b60493596bfda16fd756faf6a1f54bb5c6d7132c1fbc8e8f698790b908b6b
                                                                                                                                                                      • Opcode Fuzzy Hash: 8932d0e01e717c6f4c0693f03e830746527809c436a68a4e47b9cd1bf38d6ba7
                                                                                                                                                                      • Instruction Fuzzy Hash: E0817E74B002199FDB04DF68C885E6EBBB6FF84310F158199E509AB3A1DB30ED41CB90
                                                                                                                                                                      Function 05B218B1 Relevance: .2, Instructions: 202COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 0fce6dac0a8fda22d0e15339e1d31daaa280e1a6ca77a67685d975ecb90eefe9
                                                                                                                                                                      • Instruction ID: 26ef4c44960022b16cbf7ab9e6403e256043b0a07e405aac8533a22b4ed40c41
                                                                                                                                                                      • Opcode Fuzzy Hash: 0fce6dac0a8fda22d0e15339e1d31daaa280e1a6ca77a67685d975ecb90eefe9
                                                                                                                                                                      • Instruction Fuzzy Hash: 8A813A71600715AFCB24DF68C880A6EBBF6FF84300B558999E88A9F655D770FD41CBA0
                                                                                                                                                                      Function 05B20AC8 Relevance: .2, Instructions: 196COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: d7c78da238b87ed2bcd5e2b92d1a2efb27ab771974fc3e0de1864780ac47ad01
                                                                                                                                                                      • Instruction ID: 18354cf4cf07263fa6dd7ee77be26fb48428586a9402d9dd8e97e83ac89d49bc
                                                                                                                                                                      • Opcode Fuzzy Hash: d7c78da238b87ed2bcd5e2b92d1a2efb27ab771974fc3e0de1864780ac47ad01
                                                                                                                                                                      • Instruction Fuzzy Hash: 71619635B001199FCB14DFA9C8989ADBBF2FF88320F508069E919EB355DB31AD51CB91
                                                                                                                                                                      Function 01876E68 Relevance: .2, Instructions: 196COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 8850359d62b3f22de5ec37c83a0a3c3175f6c2a569a4acd6145032dbc502fb44
                                                                                                                                                                      • Instruction ID: 0f71a4b45d7c72aab677c518e78b19af56f29dc8e7e645dcb72fed03fa27fcef
                                                                                                                                                                      • Opcode Fuzzy Hash: 8850359d62b3f22de5ec37c83a0a3c3175f6c2a569a4acd6145032dbc502fb44
                                                                                                                                                                      • Instruction Fuzzy Hash: 09619D31A106058FCB05DF68C8944AABBF6FF89320728866AE90ADB355DF71ED05CB50
                                                                                                                                                                      Function 05B226A1 Relevance: .2, Instructions: 157COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 9ced25e0b9bc15996546722fa6f90d83cab595a0995c8be86ffc74da19915d1f
                                                                                                                                                                      • Instruction ID: 3c2ca27fe02ad05fe0e8171163ef20ac83fd07f6609bce3950632278dbad1987
                                                                                                                                                                      • Opcode Fuzzy Hash: 9ced25e0b9bc15996546722fa6f90d83cab595a0995c8be86ffc74da19915d1f
                                                                                                                                                                      • Instruction Fuzzy Hash: 5A51B034B046109FD715DB68C894B6EBBF6EF85310F6585A9E509DB3A6DB30EC01CBA0
                                                                                                                                                                      Function 018764B9 Relevance: .2, Instructions: 157COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: c483b22a9e645a12c1a467bbe89a6cd4a82b987b1735508b3380b8c3755d70e5
                                                                                                                                                                      • Instruction ID: 263b290a607f12027d407065fd64dd17d11b7aa513f010b210da4b3d7d01499c
                                                                                                                                                                      • Opcode Fuzzy Hash: c483b22a9e645a12c1a467bbe89a6cd4a82b987b1735508b3380b8c3755d70e5
                                                                                                                                                                      • Instruction Fuzzy Hash: AA513D35A10615CFCB04CFA9C88499DBBF6FF8A700B25416AE505EF325EB71AD45CB80
                                                                                                                                                                      Function 018761F0 Relevance: .1, Instructions: 142COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 84d61a7ad84a5233158faa85fe1089586187614409fd738eb3f9946af83b1b4a
                                                                                                                                                                      • Instruction ID: eb7dab8f6ff9167c2a1b38f026e00a78c3c0184715c4a350e58ca73917eeac98
                                                                                                                                                                      • Opcode Fuzzy Hash: 84d61a7ad84a5233158faa85fe1089586187614409fd738eb3f9946af83b1b4a
                                                                                                                                                                      • Instruction Fuzzy Hash: 83519E70E003099FDB04DFB8E848BCDBBB1FF89310F208559E505AB294EB75A989CB50
                                                                                                                                                                      Function 05B21C18 Relevance: .1, Instructions: 138COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: af3fefd789ebe36236d7d5ee584647f01162b7e619d224e75859f85f0b11f7df
                                                                                                                                                                      • Instruction ID: 42a5bcc209c6cd0ef3b7024ae8eee4268d3848493dae104d3ea827b643f75f63
                                                                                                                                                                      • Opcode Fuzzy Hash: af3fefd789ebe36236d7d5ee584647f01162b7e619d224e75859f85f0b11f7df
                                                                                                                                                                      • Instruction Fuzzy Hash: 1A5147747002159FCB04DF68C885E6EBBB6EF84310F5580A9E5059F3A1DB31ED42CBA0
                                                                                                                                                                      Function 01878DA8 Relevance: .1, Instructions: 136COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: a3e6bd897ddc58ff927c870b60998431aa12c460599bddb7d3aac66bf7af10b0
                                                                                                                                                                      • Instruction ID: 503d7fc958059de14803118829cac4ab17d8f2283c5725b883494e49eefde6e5
                                                                                                                                                                      • Opcode Fuzzy Hash: a3e6bd897ddc58ff927c870b60998431aa12c460599bddb7d3aac66bf7af10b0
                                                                                                                                                                      • Instruction Fuzzy Hash: DF512E34600201CFDB18CF29D8D86667BB2EF8A325B048599E915DF3A9D730ED52CF91
                                                                                                                                                                      Function 018761E0 Relevance: .1, Instructions: 130COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: dd9f84703d705264e808d1ee98f21f5451646141d7215a4e9b7a233699a058e9
                                                                                                                                                                      • Instruction ID: e268f0f5c701360181a60ea74ae0c795fc9cc95122d3d873a889926b40a138b1
                                                                                                                                                                      • Opcode Fuzzy Hash: dd9f84703d705264e808d1ee98f21f5451646141d7215a4e9b7a233699a058e9
                                                                                                                                                                      • Instruction Fuzzy Hash: 2C514B70E103099FDB04DFA8E848BDDBBB1FF89310F108559E515AB2A4EB75A989CB50
                                                                                                                                                                      Function 0187DAD8 Relevance: .1, Instructions: 116COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 9fa8847cca33af2ecf09c038e906ca62a9628b64626b7ad260c0cac1f001d955
                                                                                                                                                                      • Instruction ID: 0807965ad06d216c568af18692e78b2361744017538c7e13e9f9aa5d8942a7d9
                                                                                                                                                                      • Opcode Fuzzy Hash: 9fa8847cca33af2ecf09c038e906ca62a9628b64626b7ad260c0cac1f001d955
                                                                                                                                                                      • Instruction Fuzzy Hash: 7B41F534B00209DFDB04DB98D984A6A7BFAEFCD314B548159E909DB325DB71EE028B50
                                                                                                                                                                      Function 0187E5E8 Relevance: .1, Instructions: 112COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 5475e615a65c93e0fbdf7bb256dd97239f68917f6baa8e3bd0f87f5d273f966e
                                                                                                                                                                      • Instruction ID: d56b3be96b911f3b5c05a548d51ce929cc9b36cfb3500030462c3aecc615d841
                                                                                                                                                                      • Opcode Fuzzy Hash: 5475e615a65c93e0fbdf7bb256dd97239f68917f6baa8e3bd0f87f5d273f966e
                                                                                                                                                                      • Instruction Fuzzy Hash: 9E411C346001018FDF18DF29D8D865A7BB1EF89365B0481A9E911DF2AADB30E952CF91
                                                                                                                                                                      Function 01874CA8 Relevance: .1, Instructions: 110COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 50c576e23e58991881f8d52518cf4a0a79654a6a7a87fbf74166c9a7a0de753d
                                                                                                                                                                      • Instruction ID: ce77845bbec33e2798ad06dfbbdfd08a7034482a0b51cf7d0f7ca0305892e4cf
                                                                                                                                                                      • Opcode Fuzzy Hash: 50c576e23e58991881f8d52518cf4a0a79654a6a7a87fbf74166c9a7a0de753d
                                                                                                                                                                      • Instruction Fuzzy Hash: 4F317E30B002168FDB149F69C4986AEFBF6EF89354F10446AE506E73A4DB74DD008B90
                                                                                                                                                                      Function 05B296D0 Relevance: .1, Instructions: 101COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 2913402f4d3e68023d930cf61759f3d1e6c81b6098c2a7e203054eec9dba021e
                                                                                                                                                                      • Instruction ID: dc01e6dd82edf3c216fa62e557e818812eac46a8cd1c3730f5b83831f4cfc47a
                                                                                                                                                                      • Opcode Fuzzy Hash: 2913402f4d3e68023d930cf61759f3d1e6c81b6098c2a7e203054eec9dba021e
                                                                                                                                                                      • Instruction Fuzzy Hash: A631BC357056548FC315DB78D84891ABFF6AF8A214B19C8EAE149CF366CA35EC01C790
                                                                                                                                                                      Function 0187DEB0 Relevance: .1, Instructions: 101COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: e6aa8545b93e8ce62a3cf865c607f095aa859ac240095bc67ab700f21596b6d7
                                                                                                                                                                      • Instruction ID: 647577e40fc16398c7fc6be893836c635c2c0a79f444bb27059a7ee8dc7d3c4f
                                                                                                                                                                      • Opcode Fuzzy Hash: e6aa8545b93e8ce62a3cf865c607f095aa859ac240095bc67ab700f21596b6d7
                                                                                                                                                                      • Instruction Fuzzy Hash: 32411D3460060ADFCB05CF58C8908AABBB5FF49324B24C599F959DB361D732F916CB90
                                                                                                                                                                      Function 01870A10 Relevance: .1, Instructions: 100COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 961f62b8907e46fdc4d00faa05486449b55c042463cfaf29936420c48e34b888
                                                                                                                                                                      • Instruction ID: c35bbb629933a16306a12b32238f08e30e73778af4d7a15e7035e544d60fb29f
                                                                                                                                                                      • Opcode Fuzzy Hash: 961f62b8907e46fdc4d00faa05486449b55c042463cfaf29936420c48e34b888
                                                                                                                                                                      • Instruction Fuzzy Hash: FB416FB4E012199FDB58DFA9D940AAEFBF2BF89300F14812AE814B7354DB349A41CB50
                                                                                                                                                                      Function 0187897F Relevance: .1, Instructions: 98COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: a74c7d076cae9586a0edc4585f38d0c67a2b1d3087855b65129edd05664a601b
                                                                                                                                                                      • Instruction ID: d21fba70000f7539712d94a130e32d303c7a706ffe23621209ac974dca958333
                                                                                                                                                                      • Opcode Fuzzy Hash: a74c7d076cae9586a0edc4585f38d0c67a2b1d3087855b65129edd05664a601b
                                                                                                                                                                      • Instruction Fuzzy Hash: 5C31E4356043818FCB01DF3CC59465ABFF1AF5623070581AAD999DB3A6EA30CA09C7A2
                                                                                                                                                                      Function 05B22C81 Relevance: .1, Instructions: 97COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 5f415484501494d735b8d96ba92dbef07550d2a9650eaa6bd58ce97bcb279aaa
                                                                                                                                                                      • Instruction ID: 73e0692ba766e0977471c2ef4f608a1552df433e25e37ee2fa657bb0f37da066
                                                                                                                                                                      • Opcode Fuzzy Hash: 5f415484501494d735b8d96ba92dbef07550d2a9650eaa6bd58ce97bcb279aaa
                                                                                                                                                                      • Instruction Fuzzy Hash: E541F275E002199FCB14DFA9C9849EEFBF6FF88310B15806AE519F7250DB30A941CBA0
                                                                                                                                                                      Function 01879140 Relevance: .1, Instructions: 87COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 8cb1a6bdd67e6000985dd44c9c4a591d4e97fa05a5769e38b5ba5e705c6152d7
                                                                                                                                                                      • Instruction ID: df8571f611bb2036d522367a83e187eba074adef1acc07105e35021ec80d905e
                                                                                                                                                                      • Opcode Fuzzy Hash: 8cb1a6bdd67e6000985dd44c9c4a591d4e97fa05a5769e38b5ba5e705c6152d7
                                                                                                                                                                      • Instruction Fuzzy Hash: 05312E30A007058FC730DF6AD84866ABBF1EF89324B144A2DD5A6DB7A5D730E946CF90
                                                                                                                                                                      Function 05B23198 Relevance: .1, Instructions: 84COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: efc045dbe1b24b33a72566e58d5c5ae5e4e7fb767b635e7d21202b0e4cd90e4f
                                                                                                                                                                      • Instruction ID: a698fe739138b6b0a3af695b09879496627c8911729cef647e4bb772181d3ecc
                                                                                                                                                                      • Opcode Fuzzy Hash: efc045dbe1b24b33a72566e58d5c5ae5e4e7fb767b635e7d21202b0e4cd90e4f
                                                                                                                                                                      • Instruction Fuzzy Hash: EE31AE75604119AFDB64DF58D885FAE3BFAEB88300F108164E80ADB685D735BC41CBB0
                                                                                                                                                                      Function 01878FC0 Relevance: .1, Instructions: 84COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: cf9d26fec5a90e869d5dc4e55bdb7826655b7c782ad760087bf80714118f7a23
                                                                                                                                                                      • Instruction ID: d2cb0af74f83fb3fc08c96b52d1c73b26b004241f57d84b8cce3794eed50bf24
                                                                                                                                                                      • Opcode Fuzzy Hash: cf9d26fec5a90e869d5dc4e55bdb7826655b7c782ad760087bf80714118f7a23
                                                                                                                                                                      • Instruction Fuzzy Hash: 72310974A107018FC730DF2AC84465ABBF1EF89324B108A2DD596DB7A5D731E946CF90
                                                                                                                                                                      Function 01870A00 Relevance: .1, Instructions: 77COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: bdef9e2469e424f12044e70adf29ceab24cfd05b0cb38cebfecebbfe567bb130
                                                                                                                                                                      • Instruction ID: 1858bc9f39eeeba91fddabbcb5b6c4740640ee3a9556a1bb7d14f2a45a96edaf
                                                                                                                                                                      • Opcode Fuzzy Hash: bdef9e2469e424f12044e70adf29ceab24cfd05b0cb38cebfecebbfe567bb130
                                                                                                                                                                      • Instruction Fuzzy Hash: CE31F8B0E052588FDB19CFAAD8006EEFBF2AF8A310F04C16AE414A7255DB745A45CB54
                                                                                                                                                                      Function 018792B8 Relevance: .1, Instructions: 77COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 4acce5e4fecc9bf03ea12d34da268a06c2adc03d3109839763fb4df0eeafbc56
                                                                                                                                                                      • Instruction ID: 7f6f793ad7cdba283c4287ef72f0c947813ad4d5ee213bff167819081ba69005
                                                                                                                                                                      • Opcode Fuzzy Hash: 4acce5e4fecc9bf03ea12d34da268a06c2adc03d3109839763fb4df0eeafbc56
                                                                                                                                                                      • Instruction Fuzzy Hash: BF216B30A057058FD734DF29D98466ABBF5AF88328B046A2DE566C73E4D730EA04CB90
                                                                                                                                                                      Function 05B22859 Relevance: .1, Instructions: 75COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 399bea75c55aa8bbd44c4a2b9e8b236be8c4c9b45d1f47e03814d9f139d38136
                                                                                                                                                                      • Instruction ID: 1f51a77a88e1458fa9d945eb0feb36dabeab46ae2c3e792ad734d31c7800fc31
                                                                                                                                                                      • Opcode Fuzzy Hash: 399bea75c55aa8bbd44c4a2b9e8b236be8c4c9b45d1f47e03814d9f139d38136
                                                                                                                                                                      • Instruction Fuzzy Hash: 1321CF397046219BC7189B65D894A7DFBB2FFC9321F10816AF65ACB780DB30A8018761
                                                                                                                                                                      Function 018753C8 Relevance: .1, Instructions: 70COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: c0c15226627e63a5f911615b33601f2b5b5830a1a394e16c54ebca09c371b540
                                                                                                                                                                      • Instruction ID: 51171fe47886b05d6feb9751a7ded2bd7501a11c1604892f7e33f8ff45d0a38f
                                                                                                                                                                      • Opcode Fuzzy Hash: c0c15226627e63a5f911615b33601f2b5b5830a1a394e16c54ebca09c371b540
                                                                                                                                                                      • Instruction Fuzzy Hash: DE218E70600205DFDF28CF28D9C4A9A7F75EF48325B0482A9E915DB2EADB31D951CBA0
                                                                                                                                                                      Function 05B27F32 Relevance: .1, Instructions: 68COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 5173f8920a093696fc01a309bd406db89d72ba0ef671c72f12ba7dab42d60f0b
                                                                                                                                                                      • Instruction ID: 2802924aba81824510e693466e0f48f41cfd42fe97c8b0898538bb01d7012d68
                                                                                                                                                                      • Opcode Fuzzy Hash: 5173f8920a093696fc01a309bd406db89d72ba0ef671c72f12ba7dab42d60f0b
                                                                                                                                                                      • Instruction Fuzzy Hash: FF11E431609A948FC311CB64C590866BBF1FF49310329CA9AE86DCB751EB30FC42CB94
                                                                                                                                                                      Function 05B2370F Relevance: .1, Instructions: 68COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: b141604e55cf44acd3a1e26067ebf26ae8e99ea73f64df568f94ebd43bb902e6
                                                                                                                                                                      • Instruction ID: 6334ea3f0b4c4cd82ffce6103efae916dadb8a7ef9c4a5ddbe0c8deec88f962d
                                                                                                                                                                      • Opcode Fuzzy Hash: b141604e55cf44acd3a1e26067ebf26ae8e99ea73f64df568f94ebd43bb902e6
                                                                                                                                                                      • Instruction Fuzzy Hash: B421566250E7C44FC7038B78DD62699BFB19F43200B2A85E7C084CB2B3C6285D0ACB62
                                                                                                                                                                      Function 05B28E10 Relevance: .1, Instructions: 66COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 3c9fe981270aa470b2adc2e3648a9d62babde40473a3568a956b7a9b5707f47a
                                                                                                                                                                      • Instruction ID: 62b8cd87c80c41c0e1095963b237b67fb1ddb5515fcee627305bf9b772dbbec0
                                                                                                                                                                      • Opcode Fuzzy Hash: 3c9fe981270aa470b2adc2e3648a9d62babde40473a3568a956b7a9b5707f47a
                                                                                                                                                                      • Instruction Fuzzy Hash: 4721FF70B446059FC744DF69C585AAEBBF2FF8C720F2444A9E509AB761DB31AC41CBA0
                                                                                                                                                                      Function 01874E70 Relevance: .1, Instructions: 64COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 10f96bebc17bda6a081033f33d4967b71d44b1a0f5932c1a35bbabfca791b602
                                                                                                                                                                      • Instruction ID: 706089b75895e35ae31b0362fadd3538294d440719760e85683a78d3dcc6420c
                                                                                                                                                                      • Opcode Fuzzy Hash: 10f96bebc17bda6a081033f33d4967b71d44b1a0f5932c1a35bbabfca791b602
                                                                                                                                                                      • Instruction Fuzzy Hash: 3C213E31200B058FD735CF69D94869ABBF1EF44320B108B6DE562976A5DB31EA4ACF90
                                                                                                                                                                      Function 05B23C18 Relevance: .1, Instructions: 59COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 1157270494dd9044261a22b7902c869d379ae2bfc549c744ce663ef358f1d27c
                                                                                                                                                                      • Instruction ID: 14b1ad2495efb3e1d2cda1ecad6535f24aa79391a3cd0f284c71ee474964fa28
                                                                                                                                                                      • Opcode Fuzzy Hash: 1157270494dd9044261a22b7902c869d379ae2bfc549c744ce663ef358f1d27c
                                                                                                                                                                      • Instruction Fuzzy Hash: 7301AD763001108BC709D66DF89886AB7FAEBD923531480ABE509CB351CA36AC0287A0
                                                                                                                                                                      Function 05B27A70 Relevance: .1, Instructions: 57COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: ee25a2870cc69a02e2e95d4e98c91f4f68648ab93b31cd3efd09b7d811bb94e7
                                                                                                                                                                      • Instruction ID: a8a462c1b87ff46726880fc3f3cb99b408642ec16240c21f3cc5303a834be028
                                                                                                                                                                      • Opcode Fuzzy Hash: ee25a2870cc69a02e2e95d4e98c91f4f68648ab93b31cd3efd09b7d811bb94e7
                                                                                                                                                                      • Instruction Fuzzy Hash: DB116B71A04259AFCB019B6998588AEBFBAFF8621071480B9E508DB355DE30DD07C7B1
                                                                                                                                                                      Function 05B297C9 Relevance: .1, Instructions: 56COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 6f30a7f729515b8a6b7ca4e03ed6909a1dd5bde3826fa38c0baece8915113a40
                                                                                                                                                                      • Instruction ID: 7066cb992ff843478b9ecacbab9cac0192b902f975a8f595242946dd791e36d1
                                                                                                                                                                      • Opcode Fuzzy Hash: 6f30a7f729515b8a6b7ca4e03ed6909a1dd5bde3826fa38c0baece8915113a40
                                                                                                                                                                      • Instruction Fuzzy Hash: A8018836F041198FCF10DAA5E8496FEBB76FB84761F144166E919E3384DB3059058BA1
                                                                                                                                                                      Function 01870839 Relevance: .1, Instructions: 55COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: d11ac90d853c72b513c4f7269448fdb375354aacccca26a1d7babfaac3e77377
                                                                                                                                                                      • Instruction ID: 60b67123a7856589357c6fec6c1c9c660f57fe1497d4e45602ae6c6b229dd418
                                                                                                                                                                      • Opcode Fuzzy Hash: d11ac90d853c72b513c4f7269448fdb375354aacccca26a1d7babfaac3e77377
                                                                                                                                                                      • Instruction Fuzzy Hash: DB114C74E0420A9FCB04DFA8D4445AEFBB1FF89310F0084AAE815E7355CB35AA01CB51
                                                                                                                                                                      Function 05B29748 Relevance: .0, Instructions: 50COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 50b62b8d5d5209478bde2669af3f616f47b5895ad2de875162189813d953bbc5
                                                                                                                                                                      • Instruction ID: 07e24d7781e7e1d0e0723b53b6c1d73fabedba7efe85afeed628fe8ef67f43dc
                                                                                                                                                                      • Opcode Fuzzy Hash: 50b62b8d5d5209478bde2669af3f616f47b5895ad2de875162189813d953bbc5
                                                                                                                                                                      • Instruction Fuzzy Hash: B5011E367002149FC758DB39D988C2FBBEAEFC965431584B9E509CB768CE35EC018B90
                                                                                                                                                                      Function 01870848 Relevance: .0, Instructions: 50COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: e56160f358e10c156aaf210657be5c27dc3874cc7d64803692efb73ecc5fa157
                                                                                                                                                                      • Instruction ID: 66e6f18400ee89b4bc98950eddf13c01e5ae5712b69ea0114ac8e5b43c356551
                                                                                                                                                                      • Opcode Fuzzy Hash: e56160f358e10c156aaf210657be5c27dc3874cc7d64803692efb73ecc5fa157
                                                                                                                                                                      • Instruction Fuzzy Hash: 4411D6B4E0020A9FCB04DFA9D5549AEFBF1FF89310F108469E519E7354DB34AA01CB91
                                                                                                                                                                      Function 018763EE Relevance: .0, Instructions: 45COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: c727cc61e6c4ffbcdf57d1f111e41fb8533c0bdb9f0b727ab0f2a5d86bac9b28
                                                                                                                                                                      • Instruction ID: 8f28a27544aaca3dbbae6593ee71634575d81159ae2e773e0b3611b924ba1304
                                                                                                                                                                      • Opcode Fuzzy Hash: c727cc61e6c4ffbcdf57d1f111e41fb8533c0bdb9f0b727ab0f2a5d86bac9b28
                                                                                                                                                                      • Instruction Fuzzy Hash: CFF0C8326447448FDB01CB549C417C87B71DF56324F3940C7E308AB193E661BE45C755
                                                                                                                                                                      Function 0171D01D Relevance: .0, Instructions: 45COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693141454.000000000171D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0171D000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_171d000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 568f7eda825455c27c145b0696b72a7da1175eb0bd5b260dbfcd07187e3334ce
                                                                                                                                                                      • Instruction ID: 41dd41c973fd2d791f2aba0bcd321e89f09aee8633ac8d002394ee7e62a4e7a2
                                                                                                                                                                      • Opcode Fuzzy Hash: 568f7eda825455c27c145b0696b72a7da1175eb0bd5b260dbfcd07187e3334ce
                                                                                                                                                                      • Instruction Fuzzy Hash: 1801A7715083409AE7214AADCD88767FFD8EF413A4F18C569ED494A18AC2799841CEB1
                                                                                                                                                                      Function 05B27A62 Relevance: .0, Instructions: 43COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 5c1140f935e8cb6e46ca364ad431b36241f88ec95849a2faf4e14e4f1f76367e
                                                                                                                                                                      • Instruction ID: 856a9fee756d3a34fce2e0e2fd47cac3a5b5eec10a3c35cacbfb876014a4e8e6
                                                                                                                                                                      • Opcode Fuzzy Hash: 5c1140f935e8cb6e46ca364ad431b36241f88ec95849a2faf4e14e4f1f76367e
                                                                                                                                                                      • Instruction Fuzzy Hash: 78012876A006159FCB01DAA4CD488AEFFB6FF89310725C075E604D7350DA309E06C7B0
                                                                                                                                                                      Function 018771F4 Relevance: .0, Instructions: 42COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 30c34dde9e19ede4bbc66ae3f8ed89dae81a40ff21a02db449943dcaaca72381
                                                                                                                                                                      • Instruction ID: dd8d1f3de19b73e281671644aace35b509e47fcf41c1890e9222cd605c81a3ef
                                                                                                                                                                      • Opcode Fuzzy Hash: 30c34dde9e19ede4bbc66ae3f8ed89dae81a40ff21a02db449943dcaaca72381
                                                                                                                                                                      • Instruction Fuzzy Hash: 090128347402058FDB24CF98C598AAAB7B2EF4A344F215859E913E7364CB30DE01CB60
                                                                                                                                                                      Function 05B23BA0 Relevance: .0, Instructions: 40COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 2d7421b6661addadf27c66657660509c3d5c7be1aecff319c201aaa9b3411192
                                                                                                                                                                      • Instruction ID: e95e3c6fe9643e5c1a0f1f75d883b5cb63c085724abb5d3c82dddceb3fb2e453
                                                                                                                                                                      • Opcode Fuzzy Hash: 2d7421b6661addadf27c66657660509c3d5c7be1aecff319c201aaa9b3411192
                                                                                                                                                                      • Instruction Fuzzy Hash: ADF046313043005FC71196AEE848D4BBFFAEFC566534404AEE50DCB314DE28EC0687A0
                                                                                                                                                                      Function 0171D01C Relevance: .0, Instructions: 36COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693141454.000000000171D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0171D000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_171d000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: a0d7c739a5352f8b6825e4ada1c895021e43df17fdf6398fdf07eac1eea6f75a
                                                                                                                                                                      • Instruction ID: 43f11983b464f5f761864121745c9020d12b5e1f493f8fb7c7c06fc298d0da28
                                                                                                                                                                      • Opcode Fuzzy Hash: a0d7c739a5352f8b6825e4ada1c895021e43df17fdf6398fdf07eac1eea6f75a
                                                                                                                                                                      • Instruction Fuzzy Hash: E4F06271404344AEE7218A1ECCC8B62FFA8EB41664F18C55AED484E28AC2799845CAB1
                                                                                                                                                                      Function 05B23BB0 Relevance: .0, Instructions: 34COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 874706467d4b52b3033af7415fa90a9517dcaea1b9bd4e5ce209e987f4c886ed
                                                                                                                                                                      • Instruction ID: 1f0e02705fc1ae336bb6989139dcba3176a8dded0f1aae24a5484aa3cdf6d3fe
                                                                                                                                                                      • Opcode Fuzzy Hash: 874706467d4b52b3033af7415fa90a9517dcaea1b9bd4e5ce209e987f4c886ed
                                                                                                                                                                      • Instruction Fuzzy Hash: 3BF082313003145BC7109A6EE884D5BBBFAEBC46A53444429E50DC7314DE79ED068BA4
                                                                                                                                                                      Function 018718C8 Relevance: .0, Instructions: 33COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 0546ac0261fd899a5bc25716edbee6366e6a2a30c2b3dde0fc5ae5cbab6a2f85
                                                                                                                                                                      • Instruction ID: a9337fe3bdd5c8ab9fb27401168385187ba53f07d668e3010d7fe6ddf4819f54
                                                                                                                                                                      • Opcode Fuzzy Hash: 0546ac0261fd899a5bc25716edbee6366e6a2a30c2b3dde0fc5ae5cbab6a2f85
                                                                                                                                                                      • Instruction Fuzzy Hash: 3FF096313005414FC736DB2CA4186AEBBB6EBC97627058169D89AC774ADF38DA058B81
                                                                                                                                                                      Function 018718D8 Relevance: .0, Instructions: 31COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 8b3b7a49ab31790b33963d3675fd5e4e58402875df975dd89c6c9a3fb1add0cd
                                                                                                                                                                      • Instruction ID: 9a6c7786291293db19796c2dd954277fabee57860048fc2559794a0a0d2eeda9
                                                                                                                                                                      • Opcode Fuzzy Hash: 8b3b7a49ab31790b33963d3675fd5e4e58402875df975dd89c6c9a3fb1add0cd
                                                                                                                                                                      • Instruction Fuzzy Hash: 75F082313006014BC726962DA40C65EB7F6EBC97623008129D85AC7705EF34DE058B91
                                                                                                                                                                      Function 0187BEC0 Relevance: .0, Instructions: 30COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 4b8f194d9015015d01c78db51f1b93083a17e2847fd2b9321bd2a63a6d8f2de5
                                                                                                                                                                      • Instruction ID: 3388a8b2ca0768146011a3d54d469660ea662be8bf6fdcd4e61abf36da13ca4a
                                                                                                                                                                      • Opcode Fuzzy Hash: 4b8f194d9015015d01c78db51f1b93083a17e2847fd2b9321bd2a63a6d8f2de5
                                                                                                                                                                      • Instruction Fuzzy Hash: 38F03070D0020EDFDB64DFADC44566EBBF1AB04320F204A59D524D7391D771C6418F91
                                                                                                                                                                      Function 05B249EA Relevance: .0, Instructions: 29COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: ca030744056f1a2cc3cc940d0b430f03f1201725b8f4f836bed8ebe90ad7fd2e
                                                                                                                                                                      • Instruction ID: 5d6f0eef40d267d9628a6e18b1baac9e81e9b24b7f415aafb79762ea891ab632
                                                                                                                                                                      • Opcode Fuzzy Hash: ca030744056f1a2cc3cc940d0b430f03f1201725b8f4f836bed8ebe90ad7fd2e
                                                                                                                                                                      • Instruction Fuzzy Hash: 14F0A0353043148FC7059B68E454769BBE2FF88310F14856DD4489735DCA32DC818780
                                                                                                                                                                      Function 01875961 Relevance: .0, Instructions: 29COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 3648fa7f68656d7a1ba7f1b39f2858625afecc00a07e725e8da5aa8a911b7d56
                                                                                                                                                                      • Instruction ID: cd905b45c2d926b0018d0fcb16bcc018c9ccc08843d8f84767f387e0b58ffe88
                                                                                                                                                                      • Opcode Fuzzy Hash: 3648fa7f68656d7a1ba7f1b39f2858625afecc00a07e725e8da5aa8a911b7d56
                                                                                                                                                                      • Instruction Fuzzy Hash: 1FF0A7A295D3C44FE3028728AC503507F74D72330AF0941C6D848CB567E219DD0DE761
                                                                                                                                                                      Function 0187BEB1 Relevance: .0, Instructions: 27COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: fe0936fc3de399f8539298ea744b96b458bee070dda63bcfeea109899ff3c6f4
                                                                                                                                                                      • Instruction ID: 523864131160807c9cb7d9bb8bb1e184d51aff79e3b8f7fe46b82dd372e0d6c8
                                                                                                                                                                      • Opcode Fuzzy Hash: fe0936fc3de399f8539298ea744b96b458bee070dda63bcfeea109899ff3c6f4
                                                                                                                                                                      • Instruction Fuzzy Hash: CDF01DB4D0020ADFDB64CF9CC585AADBBB1EB04324F204E59E124D7391D774C6418F90
                                                                                                                                                                      Function 0187BF38 Relevance: .0, Instructions: 26COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 88576805be42dd8fe5709794a8f331f166dcf574f4902d2a0c69368182fb8c81
                                                                                                                                                                      • Instruction ID: 56e28217aa09f7ddfcfe6405d740d9040b009fa998ec8d185ec73e043cd8fc87
                                                                                                                                                                      • Opcode Fuzzy Hash: 88576805be42dd8fe5709794a8f331f166dcf574f4902d2a0c69368182fb8c81
                                                                                                                                                                      • Instruction Fuzzy Hash: 69F0F870D042099FCB50DFA8D585AAEBFF5AB08714F5006A9E518E3291D771D6408FC1
                                                                                                                                                                      Function 05B22820 Relevance: .0, Instructions: 25COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 52bf3880dafb3630ba2267aa9516a51dbe48a108defa397ff9f76b5eaa791802
                                                                                                                                                                      • Instruction ID: ce3f07b58fa3ea4a7bcaec50aecfedbccba9674592b0cd72ee9dde2f2a3068f7
                                                                                                                                                                      • Opcode Fuzzy Hash: 52bf3880dafb3630ba2267aa9516a51dbe48a108defa397ff9f76b5eaa791802
                                                                                                                                                                      • Instruction Fuzzy Hash: 4DE04F317417147BC7256655A805F1ABBAADBC6A11F604069E5095B7908E61BC02C794
                                                                                                                                                                      Function 05B27FA0 Relevance: .0, Instructions: 25COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 2a8a1d23ebc0f07a77c381980b770aaf1aec7bba55ea3de010d8803fc0405ae3
                                                                                                                                                                      • Instruction ID: 89b4714e54ccbfa94a568c2f5f5623ffb71090496dcdcdf8692cbf71998cb4d6
                                                                                                                                                                      • Opcode Fuzzy Hash: 2a8a1d23ebc0f07a77c381980b770aaf1aec7bba55ea3de010d8803fc0405ae3
                                                                                                                                                                      • Instruction Fuzzy Hash: 17E04632B0D9A15BCB1091599845965B6CAE759264B2C86B1F82CC7380FE21EC0383F8
                                                                                                                                                                      Function 01870E70 Relevance: .0, Instructions: 25COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 467834e9131c3ac5173d44198b95e0316f427a4976bec563fa88b53c510b8a13
                                                                                                                                                                      • Instruction ID: 70b65d5c9a70d94396439a888356fa296e37c76814beeed57a993c273333012f
                                                                                                                                                                      • Opcode Fuzzy Hash: 467834e9131c3ac5173d44198b95e0316f427a4976bec563fa88b53c510b8a13
                                                                                                                                                                      • Instruction Fuzzy Hash: C1E0D871A04208EFCB41DB78EC5409CFBF5EB4621071145E6D409DB211DA315F049B51
                                                                                                                                                                      Function 05B27110 Relevance: .0, Instructions: 24COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: dbb47c18c81c13abf95c3cf7c7f9b0af6ff7e85743403bcbb8bb1f9520f2c6ee
                                                                                                                                                                      • Instruction ID: 575f24cc44e69e43acad800c8aeb72a6f7e9da337b68942712b14d7a08dc7eb4
                                                                                                                                                                      • Opcode Fuzzy Hash: dbb47c18c81c13abf95c3cf7c7f9b0af6ff7e85743403bcbb8bb1f9520f2c6ee
                                                                                                                                                                      • Instruction Fuzzy Hash: 4AE09231701250CFC75AAB78A11445A7BB2EB8924130114EFE449C73A1DE31EC41C781
                                                                                                                                                                      Function 0187BF29 Relevance: .0, Instructions: 24COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 761c883507c83dd03e3620103a9f29341a6055c57837bd065202dbff5f2d9a3a
                                                                                                                                                                      • Instruction ID: 95ec2770e57d4d7b65c8d18672532c588de25356495db6e646552cc6a5215216
                                                                                                                                                                      • Opcode Fuzzy Hash: 761c883507c83dd03e3620103a9f29341a6055c57837bd065202dbff5f2d9a3a
                                                                                                                                                                      • Instruction Fuzzy Hash: 43F03470D0424ACECB14DFACC989AAEBFB1AF04320F500AA9E118E6291D771C7818F80
                                                                                                                                                                      Function 0187D708 Relevance: .0, Instructions: 22COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 5f0e0710b5ed24a45c25ba1dc0c6bcb8bdcf9b77698d5530c6b069606ce7afcf
                                                                                                                                                                      • Instruction ID: 8eec54a0d9cc30a8e4d3ad75edb58fd209634576fd8218668e48e0f84d197341
                                                                                                                                                                      • Opcode Fuzzy Hash: 5f0e0710b5ed24a45c25ba1dc0c6bcb8bdcf9b77698d5530c6b069606ce7afcf
                                                                                                                                                                      • Instruction Fuzzy Hash: 4DE0C934E0864CAFCB44DFA8E85579DBFB0AF84305F0085A9E84997350DB745A488F81
                                                                                                                                                                      Function 0187D718 Relevance: .0, Instructions: 19COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: b5d6fb4e6da5916094cc2bbd10b89d1c10f91a7fd90d05d9c50141107f754203
                                                                                                                                                                      • Instruction ID: 590af826e6031a4091e32bb30eb8bcee72b93e5d4d615638a38158bbe80a37cf
                                                                                                                                                                      • Opcode Fuzzy Hash: b5d6fb4e6da5916094cc2bbd10b89d1c10f91a7fd90d05d9c50141107f754203
                                                                                                                                                                      • Instruction Fuzzy Hash: 2CE09274E0420CAFCB44EFA8E94559DBBF5AB48300F0085A9E809A7354EA346A448F81
                                                                                                                                                                      Function 01875910 Relevance: .0, Instructions: 19COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 7addb754f52496a9cf80ed7aa8dd23c26641dae876fc53bf8d4e1bb567faf974
                                                                                                                                                                      • Instruction ID: 3a3f45db2fe011f5b086704ba994180fbb5de55fabc72a9e26c033a1362468d1
                                                                                                                                                                      • Opcode Fuzzy Hash: 7addb754f52496a9cf80ed7aa8dd23c26641dae876fc53bf8d4e1bb567faf974
                                                                                                                                                                      • Instruction Fuzzy Hash: CDE07DB0910385DFC702DB55FA8101C7F71EF0321070000DADC4497316DB320F189705
                                                                                                                                                                      Function 05B235B0 Relevance: .0, Instructions: 18COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: d8b9d200076069ced3bcc123c5eb1a055e226999bdada4e7c5024ac15ae637f7
                                                                                                                                                                      • Instruction ID: f1b9c0c6944f983f452930428ab828bf5a07aa3d3a793953a56c4a24da32eab0
                                                                                                                                                                      • Opcode Fuzzy Hash: d8b9d200076069ced3bcc123c5eb1a055e226999bdada4e7c5024ac15ae637f7
                                                                                                                                                                      • Instruction Fuzzy Hash: E1E04F3090A289DFCB91DFB8EA5519DBFB0EF8220171445EAD448D7265DA305E149B54
                                                                                                                                                                      Function 05B235C0 Relevance: .0, Instructions: 16COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: de23c30ffb765e0d395666322b11f3ad3227182878b35c6a40a8d34d9900f16d
                                                                                                                                                                      • Instruction ID: d21c625176847cdd2eaf5e786e63c71a6df7a694c0420783070fee0a07665cab
                                                                                                                                                                      • Opcode Fuzzy Hash: de23c30ffb765e0d395666322b11f3ad3227182878b35c6a40a8d34d9900f16d
                                                                                                                                                                      • Instruction Fuzzy Hash: F8D05E30A0120DEFCB80EFEDEE4599DBBF9EB84210B1045E8E508D3304EA316F009B90
                                                                                                                                                                      Function 01870E80 Relevance: .0, Instructions: 16COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 434ca22b4c2ebc392a4bc2e83d40805c1d9f1d65ae1f782a778031e575b1b472
                                                                                                                                                                      • Instruction ID: 3bc90b083db43f7a9be345b056b137bc540a40328f29a4f26e0618e6af9d509b
                                                                                                                                                                      • Opcode Fuzzy Hash: 434ca22b4c2ebc392a4bc2e83d40805c1d9f1d65ae1f782a778031e575b1b472
                                                                                                                                                                      • Instruction Fuzzy Hash: 01D05E30A0020CEFCB04EFACE90455DFBF9FB85221B1081A8D80AD7314EA316F009B90
                                                                                                                                                                      Function 01875920 Relevance: .0, Instructions: 16COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 238861244149a114dd724a4c0785bf73078dab4c488e111b218b6f46a66d4408
                                                                                                                                                                      • Instruction ID: b2b9150c4edba64fbb79e4c46238924eaad722826f75e515844af7bdab8147f7
                                                                                                                                                                      • Opcode Fuzzy Hash: 238861244149a114dd724a4c0785bf73078dab4c488e111b218b6f46a66d4408
                                                                                                                                                                      • Instruction Fuzzy Hash: 3FD05E30A1120DEFCB00EFA9EA4555DFBF9EB45211B1045E9DC08D3304EB326F149B94
                                                                                                                                                                      Function 0187D6E0 Relevance: .0, Instructions: 13COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 65b6f6531eae11c0404f20340f1436d18678eb1e92dbce29bc22f8da37ea6f84
                                                                                                                                                                      • Instruction ID: e46c406d5525ea203fa11827530980a09e089b0d30d6140bfa352cb0ab254bed
                                                                                                                                                                      • Opcode Fuzzy Hash: 65b6f6531eae11c0404f20340f1436d18678eb1e92dbce29bc22f8da37ea6f84
                                                                                                                                                                      • Instruction Fuzzy Hash: E0D0127050CB485FD310DB58AC217497F54EB46309F0046CAF94C4B661CBBA8C404782
                                                                                                                                                                      Function 05B29A33 Relevance: .0, Instructions: 11COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: f2b2b25000764737f00cc9c0ba2de40cc615f3b5aa58170629e3c0805a3b9a4c
                                                                                                                                                                      • Instruction ID: d347cc9b795b6633aa4ddd2707b9184bbbda97dae60ba1ac9e7827860b6111b6
                                                                                                                                                                      • Opcode Fuzzy Hash: f2b2b25000764737f00cc9c0ba2de40cc615f3b5aa58170629e3c0805a3b9a4c
                                                                                                                                                                      • Instruction Fuzzy Hash: 69D0927088431ACFEB248F84C0597EEBFB0FB05324F280859D10AA5190C7B921C8CFE1
                                                                                                                                                                      Function 05B29A17 Relevance: .0, Instructions: 11COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 3225a39814f67963bd95ae5517d9b50c3d86c2141db9c86b06bd4e369c563616
                                                                                                                                                                      • Instruction ID: 0616f66dc550be87a3b157cb2aa80d6b22a4f6fd31516723a627024c6fe2f5cc
                                                                                                                                                                      • Opcode Fuzzy Hash: 3225a39814f67963bd95ae5517d9b50c3d86c2141db9c86b06bd4e369c563616
                                                                                                                                                                      • Instruction Fuzzy Hash: 56D0927088431ACFEB208F80C059BEEBFB0FB05314F284859D20AA5190CBB821C8CFE5
                                                                                                                                                                      Function 05B29A6B Relevance: .0, Instructions: 11COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 6a48adb9de8df7b639efc8d38a55907c31f29219cf636e09300a8367ebb6a8bd
                                                                                                                                                                      • Instruction ID: 4a930bdfcca1ca2cb9a96eb686206961d14d72294599981b4fda372946f600a2
                                                                                                                                                                      • Opcode Fuzzy Hash: 6a48adb9de8df7b639efc8d38a55907c31f29219cf636e09300a8367ebb6a8bd
                                                                                                                                                                      • Instruction Fuzzy Hash: ECD0927088425ACFEB208F80C1697EEBFB1FB05314F280859D10AA5190C7B821C8CFE5
                                                                                                                                                                      Function 05B29A4F Relevance: .0, Instructions: 11COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 1e96279674ad18ce25c32fddbee2c50851b529e7045ffb70782e2eab444d04ba
                                                                                                                                                                      • Instruction ID: 84f35ba2ceb256b47c8c3e4ffe2e9e72312e35f153ea3a18c90a63d0840c0ad3
                                                                                                                                                                      • Opcode Fuzzy Hash: 1e96279674ad18ce25c32fddbee2c50851b529e7045ffb70782e2eab444d04ba
                                                                                                                                                                      • Instruction Fuzzy Hash: 4DD0927088421ACFEB248F80C1697EEBFB0FB05314F280859D10AA5190C7B821C8CFE1
                                                                                                                                                                      Function 01879D98 Relevance: .0, Instructions: 10COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: b046b76b0c52d4fb0c8690e912b837ec85e3666d3918c8b8a221889fdd40ecd8
                                                                                                                                                                      • Instruction ID: 9285608b78f735476d770447517edd87a5e9ec0e4b08626587bed30ebb447e30
                                                                                                                                                                      • Opcode Fuzzy Hash: b046b76b0c52d4fb0c8690e912b837ec85e3666d3918c8b8a221889fdd40ecd8
                                                                                                                                                                      • Instruction Fuzzy Hash: 82C0123217C7451EC702BB68B4698043F34DA1112171143E1BC35951F6D9684989E709
                                                                                                                                                                      Function 05B21BF6 Relevance: .0, Instructions: 9COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: ab8679bf9a0a61b8658a4173bbae04c086fda3dcb5ac925178b679445d740c21
                                                                                                                                                                      • Instruction ID: 4f9127a4d18f21b41709998481acac64cf928b3d83dd0ece772dc836efb67ee8
                                                                                                                                                                      • Opcode Fuzzy Hash: ab8679bf9a0a61b8658a4173bbae04c086fda3dcb5ac925178b679445d740c21
                                                                                                                                                                      • Instruction Fuzzy Hash: C4C04C36A00009DF8F00DAC4F4454DCF731EB84229B204162D51553510863129578B50
                                                                                                                                                                      Function 0187D6F0 Relevance: .0, Instructions: 9COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 7de3a52956c130ff9322e50c995c7dd064d486f3ba74616d5e6530fa2b06f287
                                                                                                                                                                      • Instruction ID: 8852bc75330cb5a187c575a93f3f2af58861646f397a09c9751e9f2e8b52842f
                                                                                                                                                                      • Opcode Fuzzy Hash: 7de3a52956c130ff9322e50c995c7dd064d486f3ba74616d5e6530fa2b06f287
                                                                                                                                                                      • Instruction Fuzzy Hash: BEB0927094530CAF8620DB99990185ABBACDA0A310F0001D9F90887320D976E91056D1
                                                                                                                                                                      Function 05B23CB0 Relevance: .0, Instructions: 8COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: ef43944f69319b644ca61720d32a4e89d6e4f4ea95b4305ff148bc96e7a6e2cd
                                                                                                                                                                      • Instruction ID: d066cc60d83a2c1af1844f2230761a08edc444ff2240c0cc7ba31da6461e4639
                                                                                                                                                                      • Opcode Fuzzy Hash: ef43944f69319b644ca61720d32a4e89d6e4f4ea95b4305ff148bc96e7a6e2cd
                                                                                                                                                                      • Instruction Fuzzy Hash: 58C08C32508040CBCA00CB10C88AB5EBB31AF80300F6E807EE1444BA45CB316812CB99
                                                                                                                                                                      Function 01879D70 Relevance: .0, Instructions: 8COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: e9633fb20b5481399d104b1043c8f7e007c41732c8fad074fd0ca4774ac107a8
                                                                                                                                                                      • Instruction ID: 31752942cc7aaac72f3eac93ecbcb53bcca033a065365f28c5b32fe4cb3dca4a
                                                                                                                                                                      • Opcode Fuzzy Hash: e9633fb20b5481399d104b1043c8f7e007c41732c8fad074fd0ca4774ac107a8
                                                                                                                                                                      • Instruction Fuzzy Hash: 56C08023D141434FCA118B2C7C557657F70B755324F1843D6C0D007193D314D402B705
                                                                                                                                                                      Function 01879DA8 Relevance: .0, Instructions: 7COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1693535636.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_1870000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 6337ca77081e13ede92c2109e9cac6a5692db0311ebb2b818dcf17eab93aeb9d
                                                                                                                                                                      • Instruction ID: ba66e61d7ca4e6c1a463f8b464fe931f3b5cef7945aa58641c9a53d48791e196
                                                                                                                                                                      • Opcode Fuzzy Hash: 6337ca77081e13ede92c2109e9cac6a5692db0311ebb2b818dcf17eab93aeb9d
                                                                                                                                                                      • Instruction Fuzzy Hash: 50B0123107471E4FC6007758F41A914BF7CE6402067400160BD0D05535DF787C88578C
                                                                                                                                                                      Function 05B2A07B Relevance: .0, Instructions: 5COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 029179d42936998fce015442d05876b5ed3d63af5936d92cea8e6abe0e9b99a9
                                                                                                                                                                      • Instruction ID: 45581a31e451f10719865f617767fcf1eae29aadf86051543d5b3bcfe1ab08da
                                                                                                                                                                      • Opcode Fuzzy Hash: 029179d42936998fce015442d05876b5ed3d63af5936d92cea8e6abe0e9b99a9
                                                                                                                                                                      • Instruction Fuzzy Hash: C8B011302002008B8F0AAB20C0A08003223AAC22083E888ECA0080A320CB3BE802CB82

                                                                                                                                                                      Non-executed Functions

                                                                                                                                                                      Function 05B21E9B Relevance: 1.8, Strings: 1, Instructions: 545COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.1720708666.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_5b20000_NotaFiscalOnline.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: 4'kq
                                                                                                                                                                      • API String ID: 0-3255046985
                                                                                                                                                                      • Opcode ID: 4565c742b7cf3b825ada84c91fe02c23fb58666160f000843a8c6e916c7a3f10
                                                                                                                                                                      • Instruction ID: 6c0633e3ee769edd7393cf4048669b8ae7a14ac501c7228e92149c36e544f982
                                                                                                                                                                      • Opcode Fuzzy Hash: 4565c742b7cf3b825ada84c91fe02c23fb58666160f000843a8c6e916c7a3f10
                                                                                                                                                                      • Instruction Fuzzy Hash: 8D2208347002148FDB19DB78C958A6DBBF2EF89214F1485A8E50ADB3A5DB35ED82CF50

                                                                                                                                                                      Executed Functions

                                                                                                                                                                      Function 06F01630 Relevance: 2.7, Strings: 2, Instructions: 159COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: $kq$$kq
                                                                                                                                                                      • API String ID: 0-3550614674
                                                                                                                                                                      • Opcode ID: f7141be7d45282ebd66e15fce4fe273fc20511e02f85fbebf0ec27909a7efada
                                                                                                                                                                      • Instruction ID: c881e213680074c51aba6f01f5a497e581038cc4dd5cfe5544bd43fbbe88495a
                                                                                                                                                                      • Opcode Fuzzy Hash: f7141be7d45282ebd66e15fce4fe273fc20511e02f85fbebf0ec27909a7efada
                                                                                                                                                                      • Instruction Fuzzy Hash: BB51B132B002098FDB55DFB8D8506AEBBF6EFC9350B14812AE814D73A4DA349D01D790
                                                                                                                                                                      Function 06F028B4 Relevance: 2.6, Strings: 2, Instructions: 141COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: (oq$LRkq
                                                                                                                                                                      • API String ID: 0-3710894217
                                                                                                                                                                      • Opcode ID: 8dcc620d690510dd39d02d19abe0e552398ec46b4a72a847c2aa587b8e6eac28
                                                                                                                                                                      • Instruction ID: 944afce9fb46e8383c1e4d41b193aadfccfd0cca0d89e4acc5fcda88292df735
                                                                                                                                                                      • Opcode Fuzzy Hash: 8dcc620d690510dd39d02d19abe0e552398ec46b4a72a847c2aa587b8e6eac28
                                                                                                                                                                      • Instruction Fuzzy Hash: 0B41F531B012149FFB499A79985877F7AABEFC4300F108429E806D73D9DE34DE4593A4
                                                                                                                                                                      Function 06F050D0 Relevance: 2.6, Strings: 2, Instructions: 98COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: $kq$$kq
                                                                                                                                                                      • API String ID: 0-3550614674
                                                                                                                                                                      • Opcode ID: 657bbdb1b83ab20651cab2e3254de34dc57285403d9a23dad831570c064bd932
                                                                                                                                                                      • Instruction ID: b811c085a56c8bb285ba91916cb3c6c2e643cb0ec712894e014bcf8e3666d568
                                                                                                                                                                      • Opcode Fuzzy Hash: 657bbdb1b83ab20651cab2e3254de34dc57285403d9a23dad831570c064bd932
                                                                                                                                                                      • Instruction Fuzzy Hash: BD315034E102189FEB549F65DA586AEBBB2AF88300F148429D801AB395DB749C45DF94
                                                                                                                                                                      Function 06F06508 Relevance: 1.5, Strings: 1, Instructions: 242COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: LRkq
                                                                                                                                                                      • API String ID: 0-1052062081
                                                                                                                                                                      • Opcode ID: 0307e0b7994825b032c2fcadc5ecd53258333515552fc0fd2f1ea95642e5a211
                                                                                                                                                                      • Instruction ID: 4c246a5f3f5baea2fc10793eb96f20d933c9f84fbf92ac4f512bbdc07f7bc1c0
                                                                                                                                                                      • Opcode Fuzzy Hash: 0307e0b7994825b032c2fcadc5ecd53258333515552fc0fd2f1ea95642e5a211
                                                                                                                                                                      • Instruction Fuzzy Hash: B481CA30F112158FEB649F65E958BAEBBF2AF84300F108429E406EB2D0DF74AC54CB90
                                                                                                                                                                      Function 06F01080 Relevance: 1.5, Strings: 1, Instructions: 212COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: (oq
                                                                                                                                                                      • API String ID: 0-3175707579
                                                                                                                                                                      • Opcode ID: d96d860c642241ee2a7f92f1267f8bd395f839e38b1b059ae3e80e48c9957a99
                                                                                                                                                                      • Instruction ID: 436d746e32cad62f1eeda048346b17e0f0a5227556b8f7cc361fde587da4127a
                                                                                                                                                                      • Opcode Fuzzy Hash: d96d860c642241ee2a7f92f1267f8bd395f839e38b1b059ae3e80e48c9957a99
                                                                                                                                                                      • Instruction Fuzzy Hash: 69718235F002149FEB44EBF5C9546AEBBA7AFC8300F148429E506AB3E4DE75DC429790
                                                                                                                                                                      Function 06F00C1C Relevance: 1.4, Strings: 1, Instructions: 160COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: (oq
                                                                                                                                                                      • API String ID: 0-3175707579
                                                                                                                                                                      • Opcode ID: dfc931f9a645c8e0733388fc634fcde110915b7a2c0e3838b167031a7b004536
                                                                                                                                                                      • Instruction ID: e1aa95919a693e33fdc521ce32fd647e8fc1932f15f59684cd7f6a8cf116e784
                                                                                                                                                                      • Opcode Fuzzy Hash: dfc931f9a645c8e0733388fc634fcde110915b7a2c0e3838b167031a7b004536
                                                                                                                                                                      • Instruction Fuzzy Hash: 8951C230A05244AFF744DBA4D8647AE7FF6EF89310F15406AE905E73C6CE799C0687A1
                                                                                                                                                                      Function 06F02878 Relevance: 1.4, Strings: 1, Instructions: 109COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: LRkq
                                                                                                                                                                      • API String ID: 0-1052062081
                                                                                                                                                                      • Opcode ID: d4faab10512ef16a17b31b4375602b0e2a091a3b69a8cef0cf93680e1ef4f495
                                                                                                                                                                      • Instruction ID: 6ce24d4dfc9bc3d0ba572f435471ff6f995ffa556c38b947e380aff2f1d385e0
                                                                                                                                                                      • Opcode Fuzzy Hash: d4faab10512ef16a17b31b4375602b0e2a091a3b69a8cef0cf93680e1ef4f495
                                                                                                                                                                      • Instruction Fuzzy Hash: 10312231B052615FFB85AF388C687BF7BA6EF81200F00046AE455C72E9EB348D4893A4
                                                                                                                                                                      Function 06F050BF Relevance: 1.4, Strings: 1, Instructions: 104COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: $kq
                                                                                                                                                                      • API String ID: 0-3037731980
                                                                                                                                                                      • Opcode ID: 7e3f4ab525373fa21bf4ce04d795467737effc06111846578c44b13dc8869ad3
                                                                                                                                                                      • Instruction ID: 9315e5fa8deb010dababfab826f1adb8edc1c79abca32e6d28212eead6fff6dd
                                                                                                                                                                      • Opcode Fuzzy Hash: 7e3f4ab525373fa21bf4ce04d795467737effc06111846578c44b13dc8869ad3
                                                                                                                                                                      • Instruction Fuzzy Hash: 9A318F30E10214DFEB549F65DA586AEBBB2EF88304F14C429D812AB3D5CBB49C42DF90
                                                                                                                                                                      Function 06F02D60 Relevance: 1.3, Strings: 1, Instructions: 90COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: LRkq
                                                                                                                                                                      • API String ID: 0-1052062081
                                                                                                                                                                      • Opcode ID: 03d77e3ccc794f929db549427709dac2f9fafe2b37e8792f65ac451698577003
                                                                                                                                                                      • Instruction ID: 985185a34660a9ac3b69e1975cc105e4838e48af902e07e5b9c539a5965bb8e3
                                                                                                                                                                      • Opcode Fuzzy Hash: 03d77e3ccc794f929db549427709dac2f9fafe2b37e8792f65ac451698577003
                                                                                                                                                                      • Instruction Fuzzy Hash: E221E231F012115FEB889A349C587BF77ABEF84200F10442AE406C72D8EF348E0593A0
                                                                                                                                                                      Function 06F028C4 Relevance: 1.3, Strings: 1, Instructions: 90COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: (oq
                                                                                                                                                                      • API String ID: 0-3175707579
                                                                                                                                                                      • Opcode ID: 0619c256a47874454a146e287cc09a86efbb3869fcd8069c402a3be45a541fae
                                                                                                                                                                      • Instruction ID: 5cf5b4ca3854c07e06fd69710581cf41b93564db2003f23aed667bba88c190c7
                                                                                                                                                                      • Opcode Fuzzy Hash: 0619c256a47874454a146e287cc09a86efbb3869fcd8069c402a3be45a541fae
                                                                                                                                                                      • Instruction Fuzzy Hash: 63216332F093549FF7955A6558542BF7F9BEFC9250F048026E909873C2EE348C02E7A5
                                                                                                                                                                      Function 06F08A10 Relevance: 1.3, Strings: 1, Instructions: 86COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: LRkq
                                                                                                                                                                      • API String ID: 0-1052062081
                                                                                                                                                                      • Opcode ID: 7ef5173de19e65b561743d533ba5ab22264206cd16be52b235cea0c54c7b2ed1
                                                                                                                                                                      • Instruction ID: 2a109581403d6493e8d8b53a93078c36d2b4e2e3bc7ee9de8417c5c05ff23f23
                                                                                                                                                                      • Opcode Fuzzy Hash: 7ef5173de19e65b561743d533ba5ab22264206cd16be52b235cea0c54c7b2ed1
                                                                                                                                                                      • Instruction Fuzzy Hash: 5321B130F01209ABEF549FA1E8597EE7BB7AB88740F208429E502A73C0DFB05D01DB91
                                                                                                                                                                      Function 06F08A20 Relevance: 1.3, Strings: 1, Instructions: 78COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: LRkq
                                                                                                                                                                      • API String ID: 0-1052062081
                                                                                                                                                                      • Opcode ID: 7a5e6d4d9f640a81245e443600d303b896040598b03e0e6ea069256fa887e584
                                                                                                                                                                      • Instruction ID: eb8b8400a9452b4e4395ec3343f5119de118419e375e02157029ceb98494e3f3
                                                                                                                                                                      • Opcode Fuzzy Hash: 7a5e6d4d9f640a81245e443600d303b896040598b03e0e6ea069256fa887e584
                                                                                                                                                                      • Instruction Fuzzy Hash: 7F218F30F01209DBEF54DFA1E5556AEBBB7AB88640F208429E502A73C4DFB06D01DB94
                                                                                                                                                                      Function 06F029C8 Relevance: .2, Instructions: 228COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: d5c8e1f290c66c48634c141041a82c5f67be8b75826dd0fc40d3e893782d0979
                                                                                                                                                                      • Instruction ID: ffdc9b166f65be8ab8a47ba6bb9b9f2c4f8e14584d3d521eeda38cf477749154
                                                                                                                                                                      • Opcode Fuzzy Hash: d5c8e1f290c66c48634c141041a82c5f67be8b75826dd0fc40d3e893782d0979
                                                                                                                                                                      • Instruction Fuzzy Hash: A8918A35A10605CFCB40EFB9D85459EB7B2FF88310B14866AE809AB354EF30ED85CB90
                                                                                                                                                                      Function 06F06EA0 Relevance: .2, Instructions: 220COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 1e2f53e680454ed13c48cc6709467d63f7e46622c980d0d1046a977dc3f2b434
                                                                                                                                                                      • Instruction ID: 1df2f969df8b30108b4f69f45c87d63344006d1d98d53ada156f621e9ab974b3
                                                                                                                                                                      • Opcode Fuzzy Hash: 1e2f53e680454ed13c48cc6709467d63f7e46622c980d0d1046a977dc3f2b434
                                                                                                                                                                      • Instruction Fuzzy Hash: 3D815B31D053958FD702DF78DC58ACABFB2EF45310F14419AE040AB2E6DB79A949CB91
                                                                                                                                                                      Function 06F06F18 Relevance: .2, Instructions: 165COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 896d2dfbca06b14d1181d358a11b19cbb9cc127ede5959613318f892e9a33cb6
                                                                                                                                                                      • Instruction ID: 6601fafb6ce5b664317a991fd0e76e54ddd997da0f13fc9e373282058c84fc1d
                                                                                                                                                                      • Opcode Fuzzy Hash: 896d2dfbca06b14d1181d358a11b19cbb9cc127ede5959613318f892e9a33cb6
                                                                                                                                                                      • Instruction Fuzzy Hash: C651C230D513599FCB01DFB8D954BDABFB2FF89310F108596E010AB2A1DB34A989CB94
                                                                                                                                                                      Function 06F029A1 Relevance: .2, Instructions: 162COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 10b20c831bafef86a6efe5af25af5c5b1e4e428107c8bb1d0955eef3e4a7e99d
                                                                                                                                                                      • Instruction ID: d17c006ed49aa3a49102fb002cb6c908adf84d8135bde748e1314cb7663d792a
                                                                                                                                                                      • Opcode Fuzzy Hash: 10b20c831bafef86a6efe5af25af5c5b1e4e428107c8bb1d0955eef3e4a7e99d
                                                                                                                                                                      • Instruction Fuzzy Hash: 8B51A075B002108FDB45DF39D954A5ABBF2EF8821071885AAE809DF399DF34ED41CBA0
                                                                                                                                                                      Function 06F06F78 Relevance: .1, Instructions: 139COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: b789b84378a4a9516f1a680b9c5c7bdac5638fd3b24dbfb3e01f9a68df41260d
                                                                                                                                                                      • Instruction ID: a9f1f3b966db8692f84f2af965ac8959885c196e020928dbac7d8e35263dc3f3
                                                                                                                                                                      • Opcode Fuzzy Hash: b789b84378a4a9516f1a680b9c5c7bdac5638fd3b24dbfb3e01f9a68df41260d
                                                                                                                                                                      • Instruction Fuzzy Hash: 52518F30E503099FDB00DFB8D954B9EBBB2FF88310F208559E114AB394DB75A889CB94
                                                                                                                                                                      Function 06F02268 Relevance: .1, Instructions: 106COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 47b69d3de5e6c8572016dcde22803dc4b742936fc05c892cc32ef5222b56fc19
                                                                                                                                                                      • Instruction ID: 3e30f30d13ef77740b4c7f8afd78604b32ad379021f94fe44edd38fdbc0359e5
                                                                                                                                                                      • Opcode Fuzzy Hash: 47b69d3de5e6c8572016dcde22803dc4b742936fc05c892cc32ef5222b56fc19
                                                                                                                                                                      • Instruction Fuzzy Hash: D4411735F102049FDB94DF69D98499EBBB6FF8C210B10816AE905EB360DB31ED41CBA0
                                                                                                                                                                      Function 06F06390 Relevance: .1, Instructions: 100COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: c98e13ecf0e029fdaf5b7253c40c635dd5777122168ab8f9fc89540e04f4a78d
                                                                                                                                                                      • Instruction ID: ec860a07d16ff4d74069c60e1680541b079be53c64f4704874e2710f621ac48f
                                                                                                                                                                      • Opcode Fuzzy Hash: c98e13ecf0e029fdaf5b7253c40c635dd5777122168ab8f9fc89540e04f4a78d
                                                                                                                                                                      • Instruction Fuzzy Hash: 2241C578A01218AFDB44DFA9D59499EBBF6FF88310B148069E905E7365DB30AC41CBA0
                                                                                                                                                                      Function 06F063A0 Relevance: .1, Instructions: 91COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: f70a3c8ff303e6b1c69cc28f45439f82883ac454c3985095d5cf458ac6bf4bf3
                                                                                                                                                                      • Instruction ID: 44f31a581391da7c24c96f57249cd8893f8eda583036714a97b90a4afc9065c5
                                                                                                                                                                      • Opcode Fuzzy Hash: f70a3c8ff303e6b1c69cc28f45439f82883ac454c3985095d5cf458ac6bf4bf3
                                                                                                                                                                      • Instruction Fuzzy Hash: AD31B378A01218DFDB44DFA9D59499DBBF6FF88310B158069E905E7365DB30EC41CB90
                                                                                                                                                                      Function 06F028E4 Relevance: .1, Instructions: 91COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 836357e4b8c9c464a2d58b75525d48ea039064f69867050e1e097e06a10bac1f
                                                                                                                                                                      • Instruction ID: 1c247a165c362b4b11de1a7b77fba06cfa271003323f3afd0014f9fb9909144a
                                                                                                                                                                      • Opcode Fuzzy Hash: 836357e4b8c9c464a2d58b75525d48ea039064f69867050e1e097e06a10bac1f
                                                                                                                                                                      • Instruction Fuzzy Hash: B9212832E163586FEB8126A46C143EA7F59CF42261F008067FE48861D2DD248991B3E0
                                                                                                                                                                      Function 06F09340 Relevance: .1, Instructions: 86COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 32485b72fd277f64acb20fb927e8f8527178655bd0b04a019490b5a02886dde0
                                                                                                                                                                      • Instruction ID: a4de2c6e2ec5a5f8e9fb87b20277657f54d53fa49a4d95f0c2b8076ab7647671
                                                                                                                                                                      • Opcode Fuzzy Hash: 32485b72fd277f64acb20fb927e8f8527178655bd0b04a019490b5a02886dde0
                                                                                                                                                                      • Instruction Fuzzy Hash: D4218E26F0A3905FE7565A715C512BF7F6FAFC9210B048066E819872C3DE748906E7A1
                                                                                                                                                                      Function 06F01062 Relevance: .1, Instructions: 85COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: c0b44192c43eb09fac3fd50ccc1e1a9efef6d9da1f8bb1efd2dd995361140f00
                                                                                                                                                                      • Instruction ID: ad5f4aa77ebb58426e1b2e4257b93c71a3abc157587352da1c7ed6576f9fcf98
                                                                                                                                                                      • Opcode Fuzzy Hash: c0b44192c43eb09fac3fd50ccc1e1a9efef6d9da1f8bb1efd2dd995361140f00
                                                                                                                                                                      • Instruction Fuzzy Hash: FE212532F05294ABFB14DBF58C546FABBEADB99281F044026E906D72C5D938CD0297A0
                                                                                                                                                                      Function 06F028D4 Relevance: .1, Instructions: 70COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: f266f91464071b9631d7f5db22ba14322b31e8ca024208a8898dedadf3b62dd2
                                                                                                                                                                      • Instruction ID: 3b413fbaf3db94ac367d439db26e56788a9987e6d98f903cd8c9c40b7b88279c
                                                                                                                                                                      • Opcode Fuzzy Hash: f266f91464071b9631d7f5db22ba14322b31e8ca024208a8898dedadf3b62dd2
                                                                                                                                                                      • Instruction Fuzzy Hash: 43112934F192541BFF9522745C1C37A6EDE8B42685F0004AAE906C77C3DCA8DD0623F6
                                                                                                                                                                      Function 06F09440 Relevance: .1, Instructions: 69COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: d03aab62f802e1aa9e2b947f52d609cd5b6d14a3fde749ef45db3b4556b5cde2
                                                                                                                                                                      • Instruction ID: 0dffafecbc8aa8f75a085ba5dc3de14cbbc3912ac5aa1b3aa77f838da58190d9
                                                                                                                                                                      • Opcode Fuzzy Hash: d03aab62f802e1aa9e2b947f52d609cd5b6d14a3fde749ef45db3b4556b5cde2
                                                                                                                                                                      • Instruction Fuzzy Hash: 27219575A00104AFEB44DF94DC50AA9B7B6EF98311F114019D815A73C1DF789C46DB90
                                                                                                                                                                      Function 06F02258 Relevance: .1, Instructions: 68COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 71f75dbfc9e4b1f72805f2586ccea56e10808615b3d253725495348d87fc8890
                                                                                                                                                                      • Instruction ID: 8e27c49c3861f3f3bc91bdb2a4e6f77d67be54aaa3b8582fda5e5e2c8b6c747b
                                                                                                                                                                      • Opcode Fuzzy Hash: 71f75dbfc9e4b1f72805f2586ccea56e10808615b3d253725495348d87fc8890
                                                                                                                                                                      • Instruction Fuzzy Hash: 98214A75E101189FDB84DF79D8849DEBBF6EF8D710B108129E815EB360DB319941CBA0
                                                                                                                                                                      Function 06F0307D Relevance: .1, Instructions: 61COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: b458859f4eec47841e419ff158bd2c46d18f3be971f38439354b13b01c59822f
                                                                                                                                                                      • Instruction ID: 6f2233840d72c12a7de345caa4a7406242a4e4570eef126106f60b3823ad0bd5
                                                                                                                                                                      • Opcode Fuzzy Hash: b458859f4eec47841e419ff158bd2c46d18f3be971f38439354b13b01c59822f
                                                                                                                                                                      • Instruction Fuzzy Hash: 9E112E35E00105AFEB44DFA4DC50AAABBB6EF8C311F158025E819A73D1DE799C46DB90
                                                                                                                                                                      Function 06F01958 Relevance: .1, Instructions: 61COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 04d1f171681961429f7e209af02defdaf35b8fe27ed77ac6e5666552dbb2e2ea
                                                                                                                                                                      • Instruction ID: 45fd8d59ad2f06eb0390cb57b454fb10f0dbae7d30eeaf43bcac978c34ebab45
                                                                                                                                                                      • Opcode Fuzzy Hash: 04d1f171681961429f7e209af02defdaf35b8fe27ed77ac6e5666552dbb2e2ea
                                                                                                                                                                      • Instruction Fuzzy Hash: 7221AF34A00255BFEB04DFE4D458AEA7FB6EF9C321F154019E80AA7381DE799C46CB90
                                                                                                                                                                      Function 06F02CC2 Relevance: .1, Instructions: 59COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 6bddfda6f7742ccd7e439ce94c35e7f43a844502174c3a4014ee8eb016a29fd8
                                                                                                                                                                      • Instruction ID: 29fc0a7045fe07996633eaa29532dc4460be99fd55a2e508543f2c9e011150fe
                                                                                                                                                                      • Opcode Fuzzy Hash: 6bddfda6f7742ccd7e439ce94c35e7f43a844502174c3a4014ee8eb016a29fd8
                                                                                                                                                                      • Instruction Fuzzy Hash: 69110431E022149BEF558A649D187DEBBFBAF88210F04806AD404B7295DA358E41C7B1
                                                                                                                                                                      Function 06F03080 Relevance: .1, Instructions: 59COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: ea33d0987f5d5c83c68923a57f3131793a160ef5493721af71d86595ae115a58
                                                                                                                                                                      • Instruction ID: debce8c3567dcf3571b894401db5dcace968f3df091361d0aff6869dfdc694ed
                                                                                                                                                                      • Opcode Fuzzy Hash: ea33d0987f5d5c83c68923a57f3131793a160ef5493721af71d86595ae115a58
                                                                                                                                                                      • Instruction Fuzzy Hash: E2113035E00205AFEB44DFA4DC50AAABBB6EF8C311F158025E805A73D1DF799C46DB90
                                                                                                                                                                      Function 06F09450 Relevance: .1, Instructions: 57COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: f601d2d8d439bbb8dd75fc9989b54978836892cb34e92e5a1ca1a568923bc7b2
                                                                                                                                                                      • Instruction ID: 57d8f36ca20ef1c24f0f095ac47529b5209c70fced00593d6f01e19d9801b563
                                                                                                                                                                      • Opcode Fuzzy Hash: f601d2d8d439bbb8dd75fc9989b54978836892cb34e92e5a1ca1a568923bc7b2
                                                                                                                                                                      • Instruction Fuzzy Hash: 57115134A00104AFEB84EFA4DC50EA9BBB6EF8C311F154019D819A73C1DF79AC46DB90
                                                                                                                                                                      Function 06F01378 Relevance: .1, Instructions: 56COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 2d710718e49234c673559ccecf70d8e1e17a372e6a8d963ff5b2c5fcd12d35e0
                                                                                                                                                                      • Instruction ID: 9283ce89636ecc6efdb6cee902e0883f8cefe63e3232beb1ec78970beb796970
                                                                                                                                                                      • Opcode Fuzzy Hash: 2d710718e49234c673559ccecf70d8e1e17a372e6a8d963ff5b2c5fcd12d35e0
                                                                                                                                                                      • Instruction Fuzzy Hash: B32132B1D002498EDB10CFAAC880AEEFBB0FF88324F10852ED859A7250C7356945CFA0
                                                                                                                                                                      Function 06F02CD0 Relevance: .1, Instructions: 55COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 655307be194b9f366b7cc933574558dca5130fb21639cf7e6310872c4549835c
                                                                                                                                                                      • Instruction ID: d020bf22599d1fdf6eeeaea750ca61a5f600e22519dd3cb8e6b587ed9b355605
                                                                                                                                                                      • Opcode Fuzzy Hash: 655307be194b9f366b7cc933574558dca5130fb21639cf7e6310872c4549835c
                                                                                                                                                                      • Instruction Fuzzy Hash: 9D01A136F001188BEF548AA8DD142EEB7F6EF88315F04803AC405B7294DB399E45DBA4
                                                                                                                                                                      Function 06F08038 Relevance: .1, Instructions: 53COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 8ec125b47c6132b2c6ed61783ce751d8722e84f43a78493bd40da8a79ceb23fc
                                                                                                                                                                      • Instruction ID: e8e0c4901adb2c6a5b2f8ba50009a4787298a1afb27fd8428cf78828ebfc4a2f
                                                                                                                                                                      • Opcode Fuzzy Hash: 8ec125b47c6132b2c6ed61783ce751d8722e84f43a78493bd40da8a79ceb23fc
                                                                                                                                                                      • Instruction Fuzzy Hash: B8017C3B7111108F8A44DA6EF89486EF7ABEBC9265354843AF609C7350DE32EC128799
                                                                                                                                                                      Function 06F01440 Relevance: .1, Instructions: 53COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: df9ade833efd972265e57329e32450c3491f713cf726f6a1dd0532ebc80cee8c
                                                                                                                                                                      • Instruction ID: 18fef3dd0f9ff2275f8cde13298f4db2dd59b1ab776a4d67ebbc43d8ad720c2c
                                                                                                                                                                      • Opcode Fuzzy Hash: df9ade833efd972265e57329e32450c3491f713cf726f6a1dd0532ebc80cee8c
                                                                                                                                                                      • Instruction Fuzzy Hash: 5A01B534E1A3492FE7499FF8A9315277FA9EAC221435509AAD905CF1F2E928C805C7E1
                                                                                                                                                                      Function 06F01380 Relevance: .1, Instructions: 53COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 6ee29c41cd2b9cf27fa086bb425e9aef8807f8f48809bb70cddc9611e59dc12f
                                                                                                                                                                      • Instruction ID: e761081a8e7fb24690007cebae3e00f1335341ef09a47862bfe9249e57a2d5a3
                                                                                                                                                                      • Opcode Fuzzy Hash: 6ee29c41cd2b9cf27fa086bb425e9aef8807f8f48809bb70cddc9611e59dc12f
                                                                                                                                                                      • Instruction Fuzzy Hash: D41124B1D002498FDB10DFAAC881ADEFBF4FF48324F10842AD859A7250C7746945CFA1
                                                                                                                                                                      Function 06F06A1F Relevance: .1, Instructions: 51COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 37a6792cab64976ec08984774f1730dc056d0edae964b7bac2c5c553fcaf6603
                                                                                                                                                                      • Instruction ID: c898a81d2ba6bed76172dbfd5fc40032fd34e9c406bdcbee911eb7b8a24dddf2
                                                                                                                                                                      • Opcode Fuzzy Hash: 37a6792cab64976ec08984774f1730dc056d0edae964b7bac2c5c553fcaf6603
                                                                                                                                                                      • Instruction Fuzzy Hash: 0701D231B0111497EB98AB69C9187EFBBE7AFC8210F208069E405FB3C0CE749D128BD0
                                                                                                                                                                      Function 06F01829 Relevance: .1, Instructions: 51COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 570e647fb449ed29d73b2e2baa567fe6c8b5b156dca63d3fa2969d74c69866be
                                                                                                                                                                      • Instruction ID: aac3694fab5f3ad19e4059c117b42cde78250e439caa59c05469bb465f7fd016
                                                                                                                                                                      • Opcode Fuzzy Hash: 570e647fb449ed29d73b2e2baa567fe6c8b5b156dca63d3fa2969d74c69866be
                                                                                                                                                                      • Instruction Fuzzy Hash: B201A232A0510897F768EAA9CC547AF7AEB9BC9304F22402DE505B73C0CEB64D0197E1
                                                                                                                                                                      Function 06F01968 Relevance: .1, Instructions: 51COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 69d2b14803ec0403bd227cb4e9c77d42042016c834c9a873891d5185215bd8ba
                                                                                                                                                                      • Instruction ID: d6aa5f23cf7ca87a78e3afd6ae5fc469bbb0c7587d82690d7ddf58bdcc5dd0ce
                                                                                                                                                                      • Opcode Fuzzy Hash: 69d2b14803ec0403bd227cb4e9c77d42042016c834c9a873891d5185215bd8ba
                                                                                                                                                                      • Instruction Fuzzy Hash: 36111F35A00215AFDB04DFE4D458AA97BB7EF9C321F154019E80AE7391DF799C46CB90
                                                                                                                                                                      Function 06F06B0C Relevance: .0, Instructions: 46COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 0521f615178445ea67365212d7df9ba2463568c7597a878702ede671dc9ac322
                                                                                                                                                                      • Instruction ID: 5ebe370a250570e2e416c165e13847abd8e8029059e6c2bfabc775c54f66d34e
                                                                                                                                                                      • Opcode Fuzzy Hash: 0521f615178445ea67365212d7df9ba2463568c7597a878702ede671dc9ac322
                                                                                                                                                                      • Instruction Fuzzy Hash: 3AF044B2F052205BFBD457E45C103BD7752DB82304F04842AE119DB2E1DA26D462A380
                                                                                                                                                                      Function 0472D01D Relevance: .0, Instructions: 45COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1709212501.000000000472D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0472D000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_472d000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: b50e25c3279c883d8c801930458ee35fa1915138fe9a8817de2ea89b3b84cc47
                                                                                                                                                                      • Instruction ID: 67505e186b3d2adc2f48fe8befb9b4d415479244c0a209ee9a0b8f3ee9cf197a
                                                                                                                                                                      • Opcode Fuzzy Hash: b50e25c3279c883d8c801930458ee35fa1915138fe9a8817de2ea89b3b84cc47
                                                                                                                                                                      • Instruction Fuzzy Hash: B101DB715083509AE7304E26DFC4767FF98DF41324F18C96AED484B366D679E841C6B1
                                                                                                                                                                      Function 06F06A30 Relevance: .0, Instructions: 45COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 80d26025988654a649ff5db11d82c997047f96baeabb209b2fe4e2000a1841d2
                                                                                                                                                                      • Instruction ID: 9bc30e5f5f41e42c20ed9559023f8600ab408ee03810d16cf21774e534f6f88a
                                                                                                                                                                      • Opcode Fuzzy Hash: 80d26025988654a649ff5db11d82c997047f96baeabb209b2fe4e2000a1841d2
                                                                                                                                                                      • Instruction Fuzzy Hash: 68018431B0021487EB98AA69C81479F7AE79FC8210F24842DE505F73D0CE759D15D7D1
                                                                                                                                                                      Function 0472D007 Relevance: .0, Instructions: 44COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000002.1709212501.000000000472D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0472D000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_2_472d000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 1f6088eb9200d575eac0f29a78c02e2f2bf1806f9786c7490d2cfc4d33a12533
                                                                                                                                                                      • Instruction ID: c355906368e6d3d3b35a0ef2607ea2027c195acc8d833aeea09b0eaf3a2a9046
                                                                                                                                                                      • Opcode Fuzzy Hash: 1f6088eb9200d575eac0f29a78c02e2f2bf1806f9786c7490d2cfc4d33a12533
                                                                                                                                                                      • Instruction Fuzzy Hash: 8B01526100D3C05EE7224B259D94752BFB4DF53224F1DC5CBD8888F2A7C2699845C772
                                                                                                                                                                      Function 06F07FB0 Relevance: .0, Instructions: 43COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: e6203f1e6312a08c0b2f6a6eb9b594f52b13f3e69989e1517c4c1ffb34ca4acb
                                                                                                                                                                      • Instruction ID: 1a96e60a28f89c9a61ef825b921b71b8f2eb2e0ce1d33c18677d0af36a8c2523
                                                                                                                                                                      • Opcode Fuzzy Hash: e6203f1e6312a08c0b2f6a6eb9b594f52b13f3e69989e1517c4c1ffb34ca4acb
                                                                                                                                                                      • Instruction Fuzzy Hash: 8FF0F0317013501BD7625A2DEC9089BBFABEFC1620304856AE51ACB391EF75FC0987E5
                                                                                                                                                                      Function 06F01431 Relevance: .0, Instructions: 38COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 3b0e4129ce449940645e043501bd9d3433eb8405b2d63eb6fb97deb8b11f9c5c
                                                                                                                                                                      • Instruction ID: 302eec3e4caa83c6d8d9652fa0d06835bf868d1db6c133b979d2c0c98067cfce
                                                                                                                                                                      • Opcode Fuzzy Hash: 3b0e4129ce449940645e043501bd9d3433eb8405b2d63eb6fb97deb8b11f9c5c
                                                                                                                                                                      • Instruction Fuzzy Hash: 20F0C274E152066FE7089FF4952152BBF9AFAD2214355086EC905CF1E2EA39C842CBD1
                                                                                                                                                                      Function 06F07FC0 Relevance: .0, Instructions: 34COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 98981d057257ee4cd5526838069a6879fa9af578a23975e51174900a1b957551
                                                                                                                                                                      • Instruction ID: 83918720ae27e1e0990fbb9a943d864850797ef90a714ebb1f26e0563ab43b43
                                                                                                                                                                      • Opcode Fuzzy Hash: 98981d057257ee4cd5526838069a6879fa9af578a23975e51174900a1b957551
                                                                                                                                                                      • Instruction Fuzzy Hash: 08F08C317003104B96A1A66EEC8095BBBEBEBC4660344843AE91AC7355EF71F80547D8
                                                                                                                                                                      Function 06F02EFA Relevance: .0, Instructions: 31COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 41bbcd83776ebac705d74f67ec6e57576bd0ef198b8a731b859679fcf777f860
                                                                                                                                                                      • Instruction ID: 7c909ae228b8e26ae496ee36245aec05a87687f900206935ded5c0fe7543cb96
                                                                                                                                                                      • Opcode Fuzzy Hash: 41bbcd83776ebac705d74f67ec6e57576bd0ef198b8a731b859679fcf777f860
                                                                                                                                                                      • Instruction Fuzzy Hash: A9E06530F2975417FFAA11654C183A67EDE0B42698F0400FBE486C67D3E5D4DA4533B2
                                                                                                                                                                      Function 06F05278 Relevance: .0, Instructions: 30COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: be4b3bf3d1a07b157ddc07aef7ce07bc76dc2b007f0657aca41ba5cb35165eaf
                                                                                                                                                                      • Instruction ID: b585eb95eacd25e166491d0ed8cc583f279cdf06471aa8acac2f5087215f2201
                                                                                                                                                                      • Opcode Fuzzy Hash: be4b3bf3d1a07b157ddc07aef7ce07bc76dc2b007f0657aca41ba5cb35165eaf
                                                                                                                                                                      • Instruction Fuzzy Hash: BFF0557AB053405FC3028A28D800797BBAA9FC9214F2404BEE088C7356CE356802CBA0
                                                                                                                                                                      Function 06F05288 Relevance: .0, Instructions: 25COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 1fc7cb750f2e992165b2904766062e4ac8e4bcdc72579d432b502368f09d1450
                                                                                                                                                                      • Instruction ID: dcc566a978a1775622c273e26153a95e6d1d3f595c09f5f258255620fdcf1266
                                                                                                                                                                      • Opcode Fuzzy Hash: 1fc7cb750f2e992165b2904766062e4ac8e4bcdc72579d432b502368f09d1450
                                                                                                                                                                      • Instruction Fuzzy Hash: 14E07D327003004BC314992BE840A57F79EDBC8264B50407DE40CC3355CD32BC02CAD0
                                                                                                                                                                      Function 06F07F3F Relevance: .0, Instructions: 25COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 97902dfbbe06b6d4d47e95b038ddec2fe97faf014ad36d2a02725cbb520d26c7
                                                                                                                                                                      • Instruction ID: d5bfc2b16972757ec74f0535e5e5a3d1717f2b6849545434d7c94f46e64fa5b3
                                                                                                                                                                      • Opcode Fuzzy Hash: 97902dfbbe06b6d4d47e95b038ddec2fe97faf014ad36d2a02725cbb520d26c7
                                                                                                                                                                      • Instruction Fuzzy Hash: 2DE0923050A359AFCB11DBB8ED1159E7FB6DB42214B108699E408D7292EB30BF0487A1
                                                                                                                                                                      Function 06F017F0 Relevance: .0, Instructions: 22COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 18f1bcef017d4fa7bfb8657c40abddd5b50589966ce9610dde66196e2dfc1e16
                                                                                                                                                                      • Instruction ID: d76a22f1bd8b082ec2326c5bd5667bd9afa2e902bf46a979654bdf0be21030e7
                                                                                                                                                                      • Opcode Fuzzy Hash: 18f1bcef017d4fa7bfb8657c40abddd5b50589966ce9610dde66196e2dfc1e16
                                                                                                                                                                      • Instruction Fuzzy Hash: B9E0C23322A2941FC3463B20AC114E57F79D75A0503184063F840872A2CD621E12DBE0
                                                                                                                                                                      Function 06F02958 Relevance: .0, Instructions: 21COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: af1448cc894fdc08d3930c0e7462d63bec04d3c0e3eeb59f2c4655c3b7d64b73
                                                                                                                                                                      • Instruction ID: bb9b3bfe77b006dc8f39466a112d48c41edf1a6061d556524855de85d0e8392d
                                                                                                                                                                      • Opcode Fuzzy Hash: af1448cc894fdc08d3930c0e7462d63bec04d3c0e3eeb59f2c4655c3b7d64b73
                                                                                                                                                                      • Instruction Fuzzy Hash: 51E04FB1905349AFCB50DFB4EA1596DBFB6EF12200B4044EAE909DB251EE346F0497A2
                                                                                                                                                                      Function 06F00C0C Relevance: .0, Instructions: 17COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 8adf3085360defe733f55fc7be303e22c84b2b6e0f9b418af5b94f2af370d5e1
                                                                                                                                                                      • Instruction ID: d5bb9c8e0c4151ee6d8dfded4acc1c6fa16e725084e79daa9e05d493467b970a
                                                                                                                                                                      • Opcode Fuzzy Hash: 8adf3085360defe733f55fc7be303e22c84b2b6e0f9b418af5b94f2af370d5e1
                                                                                                                                                                      • Instruction Fuzzy Hash: 4FD0A7332A411C6B67846758DC8596ABB99E7853613508433FA02832A4CD70BC5097D9
                                                                                                                                                                      Function 06F02968 Relevance: .0, Instructions: 16COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: b2503b4228434643844575cea24ab962dcc107f0293679fffa6b388439e81cc9
                                                                                                                                                                      • Instruction ID: 68b8541a63ca5ddb19be83a8bb83eac46e3c469e36083d52c160489c36a77bd8
                                                                                                                                                                      • Opcode Fuzzy Hash: b2503b4228434643844575cea24ab962dcc107f0293679fffa6b388439e81cc9
                                                                                                                                                                      • Instruction Fuzzy Hash: C7D05B7090120CEFCB50DFB4DA0155DBBB5EF44204B1045A9D80DD3340DF316F049795
                                                                                                                                                                      Function 06F07F50 Relevance: .0, Instructions: 16COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 0d60254e7b9016e086127b094d1a76cdf758012ad1247e86970b0e5c2c3a8792
                                                                                                                                                                      • Instruction ID: c9a5a5b7e1b81710724d64966dd3b36b25538d0a9ad4ecd835c7bb2323faf6cd
                                                                                                                                                                      • Opcode Fuzzy Hash: 0d60254e7b9016e086127b094d1a76cdf758012ad1247e86970b0e5c2c3a8792
                                                                                                                                                                      • Instruction Fuzzy Hash: 44D01730A0220CEF8B50DFB8EA0155DBBBAEB44205B1045A8D809D3300EF317E009B95
                                                                                                                                                                      Function 06F00440 Relevance: .0, Instructions: 15COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000004.00000003.1708332544.0000000006F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F00000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_4_3_6f00000_rundll32.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 1bd7237987dbe3fbb5ca91ab17ebf4ba168f82903a1186a732a8dd4d1d07ea5e
                                                                                                                                                                      • Instruction ID: 299addd80fe29a6abb37780e540b5bc93363c8a6cca2ad099f334f3bd857a1a9
                                                                                                                                                                      • Opcode Fuzzy Hash: 1bd7237987dbe3fbb5ca91ab17ebf4ba168f82903a1186a732a8dd4d1d07ea5e
                                                                                                                                                                      • Instruction Fuzzy Hash: 90D0127691F7D06FE70642954C404E69F61967304438E03D6E0449905AD41F4567D2B1

                                                                                                                                                                      Execution Graph

                                                                                                                                                                      Execution Coverage:14.5%
                                                                                                                                                                      Dynamic/Decrypted Code Coverage:97.7%
                                                                                                                                                                      Signature Coverage:1.1%
                                                                                                                                                                      Total number of Nodes:525
                                                                                                                                                                      Total number of Limit Nodes:27
                                                                                                                                                                      execution_graph 46427 572f940 46428 572f945 46427->46428 46432 5cd1109 46428->46432 46437 5cd1118 46428->46437 46429 572f9c2 46429->46429 46433 5cd1118 46432->46433 46441 5cd116c 46433->46441 46444 5cd1178 46433->46444 46439 5cd116c ConnectNamedPipe 46437->46439 46440 5cd1178 ConnectNamedPipe 46437->46440 46438 5cd1122 46438->46429 46439->46438 46440->46438 46442 5cd11cc ConnectNamedPipe 46441->46442 46443 5cd1208 46442->46443 46445 5cd11cc ConnectNamedPipe 46444->46445 46446 5cd1208 46445->46446 45980 45f0988 45981 45f09ad 45980->45981 45984 45f0448 45981->45984 45983 45f09c5 45985 45f046e 45984->45985 45989 572dd60 45984->45989 45994 572dd2e 45984->45994 45999 572dd50 45984->45999 45985->45983 45990 572dd61 45989->45990 46004 572dda0 45990->46004 46013 572de04 45990->46013 45991 572dd95 45991->45985 45995 572dd2c 45994->45995 45995->45994 45997 572dda0 8 API calls 45995->45997 45998 572de04 8 API calls 45995->45998 45996 572dd95 45996->45985 45997->45996 45998->45996 46000 572dd2c 45999->46000 46000->45999 46002 572dda0 8 API calls 46000->46002 46003 572de04 8 API calls 46000->46003 46001 572dd95 46001->45985 46002->46001 46003->46001 46005 572ddac 46004->46005 46019 572e443 46005->46019 46024 572e450 46005->46024 46006 572de08 46029 572eb38 46006->46029 46033 572eba0 46006->46033 46037 572eb28 46006->46037 46007 572de8e 46007->45991 46014 572de19 46013->46014 46016 572eba0 8 API calls 46014->46016 46017 572eb38 8 API calls 46014->46017 46018 572eb28 8 API calls 46014->46018 46015 572de8e 46015->45991 46016->46015 46017->46015 46018->46015 46020 572e450 46019->46020 46023 572e562 46020->46023 46041 572cf2c 46020->46041 46026 572e451 46024->46026 46025 572e562 46026->46025 46027 572cf2c CreateNamedPipeW 46026->46027 46028 572e558 46027->46028 46028->46006 46030 572eb4e 46029->46030 46031 572eb97 46030->46031 46045 5722a70 46030->46045 46031->46007 46034 572eb77 46033->46034 46035 572eb97 46034->46035 46036 5722a70 8 API calls 46034->46036 46035->46007 46036->46035 46038 572eb2c 46037->46038 46039 572eb97 46038->46039 46040 5722a70 8 API calls 46038->46040 46039->46007 46040->46039 46042 572e900 CreateNamedPipeW 46041->46042 46044 572e558 46042->46044 46044->46006 46046 5722a75 46045->46046 46047 5722a91 46046->46047 46050 5723918 46046->46050 46069 57239bd 46046->46069 46047->46031 46051 572398d 46050->46051 46052 5723922 46050->46052 46051->46047 46052->46051 46088 57251b3 46052->46088 46092 57257ae 46052->46092 46100 5724208 46052->46100 46105 572d4a8 46052->46105 46109 572d984 46052->46109 46113 572d701 46052->46113 46117 57248e1 46052->46117 46125 5724861 46052->46125 46133 5725720 46052->46133 46141 572d67e 46052->46141 46145 57241f9 46052->46145 46150 572d498 46052->46150 46154 5724898 46052->46154 46162 57257ba 46052->46162 46170 5725414 46052->46170 46174 57248f0 46052->46174 46070 572392d 46069->46070 46071 572398d 46070->46071 46072 57251b3 8 API calls 46070->46072 46073 57248f0 8 API calls 46070->46073 46074 5725414 8 API calls 46070->46074 46075 57257ba 8 API calls 46070->46075 46076 5724898 8 API calls 46070->46076 46077 572d498 8 API calls 46070->46077 46078 57241f9 8 API calls 46070->46078 46079 572d67e 8 API calls 46070->46079 46080 5725720 8 API calls 46070->46080 46081 5724861 8 API calls 46070->46081 46082 57248e1 8 API calls 46070->46082 46083 572d701 8 API calls 46070->46083 46084 572d984 8 API calls 46070->46084 46085 572d4a8 8 API calls 46070->46085 46086 5724208 8 API calls 46070->46086 46087 57257ae 8 API calls 46070->46087 46071->46047 46072->46071 46073->46071 46074->46071 46075->46071 46076->46071 46077->46071 46078->46071 46079->46071 46080->46071 46081->46071 46082->46071 46083->46071 46084->46071 46085->46071 46086->46071 46087->46071 46089 57251cc 46088->46089 46089->46088 46090 572555f 46089->46090 46091 5722a70 8 API calls 46089->46091 46091->46089 46093 57249c3 46092->46093 46094 5724ee2 46093->46094 46095 5724f5e 46093->46095 46182 5727c50 46093->46182 46187 5727c3f 46093->46187 46192 5728c70 46094->46192 46210 5728c5c 46094->46210 46095->46051 46102 5724209 46100->46102 46101 5724263 46101->46051 46102->46101 46268 5728060 46102->46268 46273 5728050 46102->46273 46106 572d4a9 46105->46106 46107 572d5a5 46106->46107 46318 45f6670 46106->46318 46110 572d518 46109->46110 46111 572d5a5 46110->46111 46112 45f6670 8 API calls 46110->46112 46112->46111 46114 572d518 46113->46114 46115 572d5a5 46114->46115 46116 45f6670 8 API calls 46114->46116 46116->46115 46118 57248e4 46117->46118 46119 5724ee2 46118->46119 46120 5724f5e 46118->46120 46123 5727c50 2 API calls 46118->46123 46124 5727c3f 2 API calls 46118->46124 46121 5728c70 8 API calls 46119->46121 46122 5728c5c 8 API calls 46119->46122 46120->46051 46121->46120 46122->46120 46123->46118 46124->46118 46126 5724864 46125->46126 46127 5724ee2 46126->46127 46128 572486e 46126->46128 46129 5727c50 2 API calls 46126->46129 46130 5727c3f 2 API calls 46126->46130 46131 5728c70 8 API calls 46127->46131 46132 5728c5c 8 API calls 46127->46132 46128->46051 46129->46126 46130->46126 46131->46128 46132->46128 46134 57249c3 46133->46134 46135 5724ee2 46134->46135 46136 5724f5e 46134->46136 46137 5727c50 2 API calls 46134->46137 46138 5727c3f 2 API calls 46134->46138 46139 5728c70 8 API calls 46135->46139 46140 5728c5c 8 API calls 46135->46140 46136->46051 46137->46134 46138->46134 46139->46136 46140->46136 46142 572d518 46141->46142 46143 572d5a5 46142->46143 46144 45f6670 8 API calls 46142->46144 46144->46143 46146 57241fc 46145->46146 46147 5724263 46146->46147 46148 5728060 8 API calls 46146->46148 46149 5728050 8 API calls 46146->46149 46147->46051 46148->46146 46149->46146 46151 572d49c 46150->46151 46152 572d5a5 46151->46152 46153 45f6670 8 API calls 46151->46153 46153->46152 46156 572489c 46154->46156 46155 57248bb 46155->46051 46156->46155 46157 5724ee2 46156->46157 46158 5727c50 2 API calls 46156->46158 46159 5727c3f 2 API calls 46156->46159 46160 5728c70 8 API calls 46157->46160 46161 5728c5c 8 API calls 46157->46161 46158->46156 46159->46156 46160->46155 46161->46155 46163 57249c3 46162->46163 46164 5724ee2 46163->46164 46165 5724f5e 46163->46165 46166 5727c50 2 API calls 46163->46166 46167 5727c3f 2 API calls 46163->46167 46168 5728c70 8 API calls 46164->46168 46169 5728c5c 8 API calls 46164->46169 46165->46051 46166->46163 46167->46163 46168->46165 46169->46165 46172 57251b3 46170->46172 46171 572555f 46172->46170 46172->46171 46173 5722a70 8 API calls 46172->46173 46173->46172 46175 57248f1 46174->46175 46176 5724ee2 46175->46176 46177 5724f5e 46175->46177 46180 5727c50 2 API calls 46175->46180 46181 5727c3f 2 API calls 46175->46181 46178 5728c70 8 API calls 46176->46178 46179 5728c5c 8 API calls 46176->46179 46177->46051 46178->46177 46179->46177 46180->46175 46181->46175 46183 5727c55 46182->46183 46184 5727c80 46183->46184 46228 60229b0 46183->46228 46232 60229c0 46183->46232 46184->46093 46189 5727c50 46187->46189 46188 5727c80 46188->46093 46189->46188 46190 60229b0 RegDisablePredefinedCache 46189->46190 46191 60229c0 RegDisablePredefinedCache 46189->46191 46190->46189 46191->46189 46193 5728c71 46192->46193 46194 5728ca3 46193->46194 46199 5728cd9 46193->46199 46206 5728c70 8 API calls 46194->46206 46209 5728c5c 8 API calls 46194->46209 46236 5729939 46194->46236 46242 5729217 46194->46242 46195 5728cbb 46195->46095 46196 57298a0 46197 57298c1 46196->46197 46253 45f28f0 46196->46253 46257 45f28e1 46196->46257 46197->46095 46198 5729a09 46198->46095 46202 5728c70 8 API calls 46199->46202 46203 5729217 8 API calls 46199->46203 46204 5729939 8 API calls 46199->46204 46205 5728c5c 8 API calls 46199->46205 46202->46196 46203->46196 46204->46196 46205->46196 46206->46195 46209->46195 46211 5728c6c 46210->46211 46212 5728ca3 46211->46212 46217 5728cd9 46211->46217 46218 5728c70 8 API calls 46212->46218 46219 5729217 8 API calls 46212->46219 46220 5729939 8 API calls 46212->46220 46221 5728c5c 8 API calls 46212->46221 46213 5728cbb 46213->46095 46214 57298a0 46215 57298c1 46214->46215 46222 45f28e1 8 API calls 46214->46222 46223 45f28f0 8 API calls 46214->46223 46215->46095 46216 5729a09 46216->46095 46224 5728c70 8 API calls 46217->46224 46225 5729217 8 API calls 46217->46225 46226 5729939 8 API calls 46217->46226 46227 5728c5c 8 API calls 46217->46227 46218->46213 46219->46213 46220->46213 46221->46213 46222->46216 46223->46216 46224->46214 46225->46214 46226->46214 46227->46214 46229 60229c0 46228->46229 46230 6022a79 RegDisablePredefinedCache 46229->46230 46231 6022a5c 46229->46231 46230->46231 46233 60229c5 46232->46233 46234 6022a79 RegDisablePredefinedCache 46233->46234 46235 6022a5c 46233->46235 46234->46235 46238 57298b2 46236->46238 46237 57298c1 46237->46195 46238->46237 46240 45f28e1 8 API calls 46238->46240 46241 45f28f0 8 API calls 46238->46241 46239 5729a09 46239->46195 46240->46239 46241->46239 46243 5728f0d 46242->46243 46247 5728c70 8 API calls 46243->46247 46248 5729217 8 API calls 46243->46248 46249 5729939 8 API calls 46243->46249 46250 5728c5c 8 API calls 46243->46250 46244 57298c1 46244->46195 46245 57298a0 46245->46244 46251 45f28e1 8 API calls 46245->46251 46252 45f28f0 8 API calls 46245->46252 46246 5729a09 46246->46195 46247->46245 46248->46245 46249->46245 46250->46245 46251->46246 46252->46246 46254 45f2916 46253->46254 46261 185fa98 46254->46261 46255 45f2922 46258 45f2916 46257->46258 46260 185fa98 8 API calls 46258->46260 46259 45f2922 46260->46259 46262 185fabb 46261->46262 46263 185facb 46261->46263 46264 185fac4 46262->46264 46265 185ff20 8 API calls 46262->46265 46266 185f910 8 API calls 46263->46266 46267 185fa98 8 API calls 46263->46267 46264->46255 46265->46264 46266->46262 46267->46262 46269 5728061 46268->46269 46272 572806b 46269->46272 46278 5729d58 46269->46278 46286 5729d48 46269->46286 46272->46102 46274 5728054 46273->46274 46275 572806b 46274->46275 46276 5729d58 8 API calls 46274->46276 46277 5729d48 8 API calls 46274->46277 46275->46102 46276->46275 46277->46275 46279 5729d59 46278->46279 46280 572a546 46279->46280 46281 5729d99 46279->46281 46294 572c726 46279->46294 46302 572c98a 46279->46302 46310 6022030 46280->46310 46314 6022040 46280->46314 46281->46272 46287 5729d50 46286->46287 46288 572a546 46287->46288 46289 5729d99 46287->46289 46292 572c726 8 API calls 46287->46292 46293 572c98a 8 API calls 46287->46293 46290 6022030 8 API calls 46288->46290 46291 6022040 8 API calls 46288->46291 46289->46272 46290->46289 46291->46289 46292->46288 46293->46288 46296 572c730 46294->46296 46295 572c9b9 46295->46280 46296->46295 46297 5cd02cf 8 API calls 46296->46297 46298 5cd095e 8 API calls 46296->46298 46299 5cd0967 8 API calls 46296->46299 46300 5cd0006 8 API calls 46296->46300 46301 5cd0040 8 API calls 46296->46301 46297->46296 46298->46296 46299->46296 46300->46296 46301->46296 46304 572c7f9 46302->46304 46303 572c9b9 46303->46280 46304->46303 46305 5cd02cf 8 API calls 46304->46305 46306 5cd095e 8 API calls 46304->46306 46307 5cd0967 8 API calls 46304->46307 46308 5cd0006 8 API calls 46304->46308 46309 5cd0040 8 API calls 46304->46309 46305->46304 46306->46304 46307->46304 46308->46304 46309->46304 46311 602203f 46310->46311 46312 6022131 46311->46312 46313 5722a70 8 API calls 46311->46313 46313->46312 46315 6022067 46314->46315 46316 6022131 46315->46316 46317 5722a70 8 API calls 46315->46317 46317->46316 46319 45f66b0 46318->46319 46320 45f0448 8 API calls 46319->46320 46321 45f66cb 46320->46321 46321->46107 46447 45f5ea8 46449 45f5ecc 46447->46449 46450 45f5edc 46447->46450 46448 45f5ed5 46449->46448 46453 45f646d 8 API calls 46449->46453 46454 45f64d8 8 API calls 46449->46454 46455 45f646d 46450->46455 46464 45f64d8 46450->46464 46453->46449 46454->46449 46456 45f645c 46455->46456 46456->46455 46457 45f6539 46456->46457 46459 45f64d7 46456->46459 46462 185f910 8 API calls 46457->46462 46458 45f6504 46458->46449 46460 45f64fb 46459->46460 46461 185f910 8 API calls 46459->46461 46460->46458 46463 185f910 8 API calls 46460->46463 46461->46460 46462->46460 46463->46460 46466 45f650b 46464->46466 46467 45f64fb 46464->46467 46465 45f6504 46465->46449 46466->46467 46468 185f910 8 API calls 46466->46468 46467->46465 46469 185f910 8 API calls 46467->46469 46468->46467 46469->46467 46322 5cd34a0 46325 5cd34b2 46322->46325 46323 5cd34f6 46325->46323 46326 5cd3500 46325->46326 46328 5cd353b 46326->46328 46327 5cd3980 46328->46327 46331 1857481 46328->46331 46335 1857490 46328->46335 46332 18574ba 46331->46332 46333 18574d5 46332->46333 46339 185f910 46332->46339 46333->46328 46336 18574ba 46335->46336 46337 18574d5 46336->46337 46338 185f910 8 API calls 46336->46338 46337->46328 46338->46337 46340 185f933 46339->46340 46341 185f943 46339->46341 46342 185f93c 46340->46342 46350 45f47b0 8 API calls 46340->46350 46351 45f4830 8 API calls 46340->46351 46352 45f4820 8 API calls 46340->46352 46341->46340 46343 185f910 8 API calls 46341->46343 46344 185fa98 8 API calls 46341->46344 46353 185a4b8 46341->46353 46359 45f4820 46341->46359 46365 185a4c8 46341->46365 46371 45f4830 46341->46371 46377 45f47b0 46341->46377 46342->46333 46343->46340 46344->46340 46350->46340 46351->46340 46352->46340 46354 185a4c8 46353->46354 46355 185a4ed 46354->46355 46356 45f47b0 8 API calls 46354->46356 46357 45f4830 8 API calls 46354->46357 46358 45f4820 8 API calls 46354->46358 46355->46340 46356->46355 46357->46355 46358->46355 46361 45f4864 46359->46361 46362 45f4854 46359->46362 46360 45f485d 46360->46340 46364 185f910 8 API calls 46361->46364 46362->46360 46363 45f6670 8 API calls 46362->46363 46363->46360 46364->46362 46366 185a4f9 46365->46366 46367 185a4ed 46365->46367 46366->46367 46368 45f47b0 8 API calls 46366->46368 46369 45f4830 8 API calls 46366->46369 46370 45f4820 8 API calls 46366->46370 46367->46340 46368->46367 46369->46367 46370->46367 46373 45f4854 46371->46373 46374 45f4864 46371->46374 46372 45f485d 46372->46340 46373->46372 46375 45f6670 8 API calls 46373->46375 46376 185f910 8 API calls 46374->46376 46375->46372 46376->46373 46378 45f47b3 46377->46378 46379 45f47bb 46377->46379 46378->46379 46380 45f4854 46378->46380 46383 185f910 8 API calls 46378->46383 46379->46340 46381 45f485d 46380->46381 46382 45f6670 8 API calls 46380->46382 46381->46340 46382->46381 46383->46380 46384 185f768 46385 185f793 46384->46385 46386 185f78c 46384->46386 46386->46385 46387 185f910 8 API calls 46386->46387 46387->46385 46470 1851238 46471 1851239 46470->46471 46477 1850e65 46471->46477 46483 1850e69 46471->46483 46489 1850e61 46471->46489 46495 1850e24 46471->46495 46472 1851282 46479 1850e4e 46477->46479 46478 1850e9e 46479->46478 46501 18536a0 46479->46501 46509 18536b0 46479->46509 46480 185133b 46480->46472 46484 1850e4e 46483->46484 46485 1850e9e 46484->46485 46487 18536a0 9 API calls 46484->46487 46488 18536b0 9 API calls 46484->46488 46486 185133b 46486->46472 46487->46486 46488->46486 46491 1850e4e 46489->46491 46490 1850e9e 46491->46490 46493 18536a0 9 API calls 46491->46493 46494 18536b0 9 API calls 46491->46494 46492 185133b 46492->46472 46493->46492 46494->46492 46496 1850e2d 46495->46496 46497 1850e9e 46496->46497 46499 18536a0 9 API calls 46496->46499 46500 18536b0 9 API calls 46496->46500 46498 185133b 46498->46472 46499->46498 46500->46498 46502 18536a3 46501->46502 46503 18536cc 46501->46503 46502->46503 46517 1854c6f 46502->46517 46504 1853764 46503->46504 46522 5722d43 46503->46522 46528 5722d50 46503->46528 46504->46480 46505 185375c 46505->46480 46510 18536c6 46509->46510 46514 1854c6f RtlGetVersion 46510->46514 46511 1853764 46511->46480 46512 18536cc 46512->46511 46515 5722d43 8 API calls 46512->46515 46516 5722d50 8 API calls 46512->46516 46513 185375c 46513->46480 46514->46512 46515->46513 46516->46513 46519 1854c90 46517->46519 46518 1854cc6 46518->46503 46519->46518 46520 1854d1d RtlGetVersion 46519->46520 46521 1854dda 46520->46521 46521->46503 46523 5722d4f 46522->46523 46534 5722f90 46523->46534 46548 5723018 46523->46548 46563 5723028 46523->46563 46524 5722ed6 46524->46505 46529 5722d65 46528->46529 46531 5722f90 8 API calls 46529->46531 46532 5723028 8 API calls 46529->46532 46533 5723018 8 API calls 46529->46533 46530 5722ed6 46530->46505 46531->46530 46532->46530 46533->46530 46536 5722f94 46534->46536 46535 5722fbf 46535->46524 46536->46535 46577 5723117 46536->46577 46581 5723128 46536->46581 46537 5723049 46546 5723117 8 API calls 46537->46546 46547 5723128 8 API calls 46537->46547 46538 5723068 46543 5723117 8 API calls 46538->46543 46544 5723128 8 API calls 46538->46544 46539 57230d2 46539->46524 46540 5723086 46540->46539 46545 572dc40 8 API calls 46540->46545 46543->46540 46544->46540 46545->46539 46546->46538 46547->46538 46549 5723027 46548->46549 46552 5723086 46548->46552 46550 5723037 46549->46550 46585 57230d8 46549->46585 46551 5723049 46550->46551 46558 5723117 8 API calls 46550->46558 46559 5723128 8 API calls 46550->46559 46560 5723117 8 API calls 46551->46560 46561 5723128 8 API calls 46551->46561 46554 57230d2 46552->46554 46593 572dc40 46552->46593 46553 5723068 46556 5723117 8 API calls 46553->46556 46557 5723128 8 API calls 46553->46557 46554->46524 46556->46552 46557->46552 46558->46551 46559->46551 46560->46553 46561->46553 46570 57230d8 8 API calls 46563->46570 46564 5723037 46565 5723049 46564->46565 46571 5723117 8 API calls 46564->46571 46572 5723128 8 API calls 46564->46572 46573 5723117 8 API calls 46565->46573 46574 5723128 8 API calls 46565->46574 46566 5723068 46575 5723117 8 API calls 46566->46575 46576 5723128 8 API calls 46566->46576 46567 5723086 46568 572dc40 8 API calls 46567->46568 46569 57230d2 46567->46569 46568->46569 46569->46524 46570->46564 46571->46565 46572->46565 46573->46566 46574->46566 46575->46567 46576->46567 46579 572315a 46577->46579 46578 5723170 46578->46578 46579->46578 46580 5722a70 8 API calls 46579->46580 46580->46579 46583 572315a 46581->46583 46582 5723170 46582->46582 46583->46582 46584 5722a70 8 API calls 46583->46584 46584->46583 46586 57230dc 46585->46586 46589 5723117 8 API calls 46586->46589 46590 5723128 8 API calls 46586->46590 46587 5723100 46591 5723117 8 API calls 46587->46591 46592 5723128 8 API calls 46587->46592 46588 5723112 46588->46550 46589->46587 46590->46587 46591->46588 46592->46588 46594 572dc1b 46593->46594 46595 572dc4a 46593->46595 46594->46554 46596 572de04 8 API calls 46595->46596 46596->46595 46388 45f0b30 46391 45f0b6c 46388->46391 46389 45f0b55 46393 45f0b70 46391->46393 46392 45f0b8d 46392->46389 46393->46392 46397 45f1178 46393->46397 46406 45f1170 46393->46406 46394 45f0c15 46394->46389 46398 45f119d 46397->46398 46399 45f1264 46397->46399 46398->46399 46403 45f1178 CryptProtectData 46398->46403 46405 45f1170 CryptProtectData 46398->46405 46415 45f13cf 46398->46415 46419 45f1433 46398->46419 46400 45f148d 46399->46400 46423 45f0e88 46399->46423 46400->46394 46403->46399 46405->46399 46407 45f119d 46406->46407 46410 45f1264 46406->46410 46407->46410 46411 45f13cf CryptProtectData 46407->46411 46412 45f1178 CryptProtectData 46407->46412 46413 45f1433 CryptProtectData 46407->46413 46414 45f1170 CryptProtectData 46407->46414 46408 45f148d 46408->46394 46409 45f0e88 CryptProtectData 46409->46408 46410->46408 46410->46409 46411->46410 46412->46410 46413->46410 46414->46410 46416 45f13e3 46415->46416 46417 45f148d 46416->46417 46418 45f0e88 CryptProtectData 46416->46418 46417->46399 46418->46417 46420 45f1455 46419->46420 46421 45f0e88 CryptProtectData 46420->46421 46422 45f148d 46421->46422 46422->46399 46424 45f1678 CryptProtectData 46423->46424 46426 45f1703 46424->46426 46426->46400

                                                                                                                                                                      Executed Functions

                                                                                                                                                                      Function 0572CF2C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 72pipeCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 880 572cf2c-572e942 882 572e944-572e947 880->882 883 572e94a-572e9af CreateNamedPipeW 880->883 882->883 885 572e9b1-572e9b7 883->885 886 572e9b8-572e9d9 883->886 885->886
                                                                                                                                                                      APIs
                                                                                                                                                                      • CreateNamedPipeW.KERNEL32(00000000,00000001,00000008,?,?,?,00000001,00000004), ref: 0572E99C
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2958801192.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_5720000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CreateNamedPipe
                                                                                                                                                                      • String ID: 4Lkq
                                                                                                                                                                      • API String ID: 2489174969-2256942984
                                                                                                                                                                      • Opcode ID: b8b6a6cdaeb012671f3548d52a6738bc1c32d463a8802882f934f7fb91b27771
                                                                                                                                                                      • Instruction ID: de75230a230cf6170dac4dd789903c4d585b8512e887606ca2b3f31361603d32
                                                                                                                                                                      • Opcode Fuzzy Hash: b8b6a6cdaeb012671f3548d52a6738bc1c32d463a8802882f934f7fb91b27771
                                                                                                                                                                      • Instruction Fuzzy Hash: C63123B5800208DFCB20CF9AC988A8EBFF5FF48314F14C46AE959AB261C375A855CF51
                                                                                                                                                                      Function 05CD25C0 Relevance: 1.6, APIs: 1, Instructions: 93processCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • CreateProcessAsUserW.KERNEL32(?,00000000,00000000,?,?,?,?,?,00000000,?,?), ref: 05CD268F
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2960310651.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_5cd0000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CreateProcessUser
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2217836671-0
                                                                                                                                                                      • Opcode ID: cd53bbd722d0c97b79f82451c5ae37d234bab18076ed6f5cb5b897a9b29a4cf0
                                                                                                                                                                      • Instruction ID: 0686eb8bcfe2cd14a8a7e67a4ce3d07a679ada843f3617f45b05d68c856599db
                                                                                                                                                                      • Opcode Fuzzy Hash: cd53bbd722d0c97b79f82451c5ae37d234bab18076ed6f5cb5b897a9b29a4cf0
                                                                                                                                                                      • Instruction Fuzzy Hash: 6C410476900309DFCB11CFA9C884ADEBBF5FF48310F15882AE958A7250D735AA55CFA0
                                                                                                                                                                      Function 045F0E88 Relevance: 1.6, APIs: 1, Instructions: 64encryptionCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • CryptProtectData.CRYPT32(?,00000000,?,?,?,?,?), ref: 045F16EE
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2953945413.00000000045F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045F0000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_45f0000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CryptDataProtect
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3091777813-0
                                                                                                                                                                      • Opcode ID: 57e76b2fa037d9b6235fe74898684df41ce62cc1894b21817fd9990c8d7b368a
                                                                                                                                                                      • Instruction ID: 383d889bc6ac8abc127611bd704bc7ab6275325b394a64411e1f4856b47326b3
                                                                                                                                                                      • Opcode Fuzzy Hash: 57e76b2fa037d9b6235fe74898684df41ce62cc1894b21817fd9990c8d7b368a
                                                                                                                                                                      • Instruction Fuzzy Hash: 332168B6800249DFCF10CF9AC844ADEBBF5FF48310F14842AEA18A7210D339A951DFA1
                                                                                                                                                                      Function 045F1670 Relevance: 1.6, APIs: 1, Instructions: 63encryptionCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • CryptProtectData.CRYPT32(?,00000000,?,?,?,?,?), ref: 045F16EE
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2953945413.00000000045F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 045F0000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_45f0000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CryptDataProtect
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3091777813-0
                                                                                                                                                                      • Opcode ID: f22c4366bef975ce46686a15c747909fecf447262ac1ed6d22bc3fbd0d457007
                                                                                                                                                                      • Instruction ID: ead72112a3c1c9e330ef025f0c7dfd0470ac888245e500be2da4d54ef15c387f
                                                                                                                                                                      • Opcode Fuzzy Hash: f22c4366bef975ce46686a15c747909fecf447262ac1ed6d22bc3fbd0d457007
                                                                                                                                                                      • Instruction Fuzzy Hash: 572107B6800249DFCB10CF9AD844ADEBBF1FB88310F15842AE958A7211D735A955DFA1
                                                                                                                                                                      Function 01854C6F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 514 1854c6f-1854cb3 519 1854cb5-1854cc4 call 1854848 514->519 520 1854d02-1854d08 514->520 523 1854cc6-1854ccb 519->523 524 1854d09-1854dd8 RtlGetVersion 519->524 536 1854cce call 18552e8 523->536 537 1854cce call 18552f8 523->537 529 1854de1-1854e24 524->529 530 1854dda-1854de0 524->530 526 1854cd4 526->520 534 1854e26 529->534 535 1854e2b-1854e32 529->535 530->529 534->535 536->526 537->526
                                                                                                                                                                      APIs
                                                                                                                                                                      • RtlGetVersion.NTDLL(0000009C), ref: 01854DBE
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2933598389.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_1850000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Version
                                                                                                                                                                      • String ID: `Qkq$`Qkq
                                                                                                                                                                      • API String ID: 1889659487-2839243183
                                                                                                                                                                      • Opcode ID: e862d03322fa0ca5b9ed7e5e3433b02a4d4a8ec8fdf875a8f6e0176200145c7a
                                                                                                                                                                      • Instruction ID: dc78cf15548831708c428c49780a55246d8d921c9cef5288be3f512fb6295098
                                                                                                                                                                      • Opcode Fuzzy Hash: e862d03322fa0ca5b9ed7e5e3433b02a4d4a8ec8fdf875a8f6e0176200145c7a
                                                                                                                                                                      • Instruction Fuzzy Hash: FB417170A003199FDB619F68D808BAEBBB5FB45310F1085A9D50C97394DB745E88CF92
                                                                                                                                                                      Function 06020244 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 147fileCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 802 6020244-602024d 803 60201ee-602021b 802->803 804 602024f-60202ac 802->804 815 6020224 803->815 816 602021d-6020222 803->816 805 6020300-6020383 CreateFileA 804->805 806 60202ae-60202d3 804->806 821 6020385-602038b 805->821 822 602038c-60203ca 805->822 806->805 811 60202d5-60202d7 806->811 813 60202fa-60202fd 811->813 814 60202d9-60202e3 811->814 813->805 818 60202e7-60202f6 814->818 819 60202e5 814->819 820 6020229-6020231 815->820 816->820 818->818 823 60202f8 818->823 819->818 832 6020233 call 6020250 820->832 833 6020233 call 6020244 820->833 821->822 828 60203da 822->828 829 60203cc-60203d0 822->829 823->813 826 6020238-602023a 831 60203db 828->831 829->828 830 60203d2 829->830 830->828 831->831 832->826 833->826
                                                                                                                                                                      APIs
                                                                                                                                                                      • CreateFileA.KERNEL32(?,?,?,?,?,00000001,00000004), ref: 0602036D
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2961324954.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_6020000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CreateFile
                                                                                                                                                                      • String ID: 4Lkq
                                                                                                                                                                      • API String ID: 823142352-2256942984
                                                                                                                                                                      • Opcode ID: 721558a3a9465982091cda8d26b3886ec34ba97410572d6407e5463b9e2414a8
                                                                                                                                                                      • Instruction ID: 99475b09e325749655eda1d16b7a398072211103671143fbc94f54fa65ecd67e
                                                                                                                                                                      • Opcode Fuzzy Hash: 721558a3a9465982091cda8d26b3886ec34ba97410572d6407e5463b9e2414a8
                                                                                                                                                                      • Instruction Fuzzy Hash: 1F518CB1D4035A9FDB50CFA8C945B9EBFF5BF48304F14802AE809AB395D7749845CB81
                                                                                                                                                                      Function 06020250 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 116fileCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 834 6020250-60202ac 835 6020300-6020383 CreateFileA 834->835 836 60202ae-60202d3 834->836 845 6020385-602038b 835->845 846 602038c-60203ca 835->846 836->835 839 60202d5-60202d7 836->839 840 60202fa-60202fd 839->840 841 60202d9-60202e3 839->841 840->835 843 60202e7-60202f6 841->843 844 60202e5 841->844 843->843 847 60202f8 843->847 844->843 845->846 851 60203da 846->851 852 60203cc-60203d0 846->852 847->840 854 60203db 851->854 852->851 853 60203d2 852->853 853->851 854->854
                                                                                                                                                                      APIs
                                                                                                                                                                      • CreateFileA.KERNEL32(?,?,?,?,?,00000001,00000004), ref: 0602036D
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2961324954.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_6020000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CreateFile
                                                                                                                                                                      • String ID: 4Lkq
                                                                                                                                                                      • API String ID: 823142352-2256942984
                                                                                                                                                                      • Opcode ID: be91776f5b2c20889900e776932c64bfc77ac94cdc1413e56ea919ab316d282b
                                                                                                                                                                      • Instruction ID: ea67c45873a6ba64e56c84f9402b244f389a656607d0ec5b1fb19dd86833f5d2
                                                                                                                                                                      • Opcode Fuzzy Hash: be91776f5b2c20889900e776932c64bfc77ac94cdc1413e56ea919ab316d282b
                                                                                                                                                                      • Instruction Fuzzy Hash: 194135B1D0035A9FDB50CFA9C944B8EBFF5BF48304F24812AE809AB265D7759845CF91
                                                                                                                                                                      Function 060229C0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 91registryCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 855 60229c0-6022a4b 862 6022a5c-6022a74 855->862 863 6022a4d-6022a5a 855->863 864 6022b36-6022b3e 862->864 863->862 867 6022a79-6022aa8 RegDisablePredefinedCache 863->867 870 6022b3f 864->870 868 6022ab1-6022acc call 6022888 867->868 869 6022aaa-6022ab0 867->869 874 6022ad1-6022aed 868->874 869->868 870->870 877 6022af8-6022b34 874->877 878 6022aef 874->878 877->864 878->877
                                                                                                                                                                      APIs
                                                                                                                                                                      • RegDisablePredefinedCache.ADVAPI32 ref: 06022A91
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2961324954.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_6020000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CacheDisablePredefined
                                                                                                                                                                      • String ID: `Qkq
                                                                                                                                                                      • API String ID: 1885667121-3591872350
                                                                                                                                                                      • Opcode ID: 0dea18f612f6de511e0082c39a6743dad5c059a3709d3a703592d717b024c22a
                                                                                                                                                                      • Instruction ID: 329e803213be11dd82353a8d8bd06d9c2590cc83b0ecbf5fd955d9d548f4daf5
                                                                                                                                                                      • Opcode Fuzzy Hash: 0dea18f612f6de511e0082c39a6743dad5c059a3709d3a703592d717b024c22a
                                                                                                                                                                      • Instruction Fuzzy Hash: 2E315470E002199FDB64DFA9D958B9EBBF1AF48310F10842AE805AB394DB745945CF91
                                                                                                                                                                      Function 0572E8F8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 71pipeCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 889 572e8f8-572e942 891 572e944-572e947 889->891 892 572e94a-572e9af CreateNamedPipeW 889->892 891->892 894 572e9b1-572e9b7 892->894 895 572e9b8-572e9d9 892->895 894->895
                                                                                                                                                                      APIs
                                                                                                                                                                      • CreateNamedPipeW.KERNEL32(00000000,00000001,00000008,?,?,?,00000001,00000004), ref: 0572E99C
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2958801192.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_5720000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CreateNamedPipe
                                                                                                                                                                      • String ID: 4Lkq
                                                                                                                                                                      • API String ID: 2489174969-2256942984
                                                                                                                                                                      • Opcode ID: 48676ce3607495c2fcfbe61d3eca15b0096ffd715c729b165541dd62c8c154a6
                                                                                                                                                                      • Instruction ID: 9fc7d96003a94a668002fe43392bafaf061d6c504e37629f942eb1f859c65ec4
                                                                                                                                                                      • Opcode Fuzzy Hash: 48676ce3607495c2fcfbe61d3eca15b0096ffd715c729b165541dd62c8c154a6
                                                                                                                                                                      • Instruction Fuzzy Hash: 6C3136B6800208DFCB10CF9AC588A8EBFF5FF48314F14C02AE958AB261D375A855CF51
                                                                                                                                                                      Function 05CD25B8 Relevance: 1.6, APIs: 1, Instructions: 93processCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • CreateProcessAsUserW.KERNEL32(?,00000000,00000000,?,?,?,?,?,00000000,?,?), ref: 05CD268F
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2960310651.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_5cd0000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CreateProcessUser
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2217836671-0
                                                                                                                                                                      • Opcode ID: f3ef94003b4741c05bf98eedba3df69312fdfaece3106687a4656a24d732503a
                                                                                                                                                                      • Instruction ID: bee72e8564191d5c6396e32840d6d0e870470fc166b05e180e0041308fa67b19
                                                                                                                                                                      • Opcode Fuzzy Hash: f3ef94003b4741c05bf98eedba3df69312fdfaece3106687a4656a24d732503a
                                                                                                                                                                      • Instruction Fuzzy Hash: F54113B6900309DFCB11CFA9C984ADEBBF1FF48310F15882AE958A7250D735AA55DF60
                                                                                                                                                                      Function 05CD116C Relevance: 1.6, APIs: 1, Instructions: 65pipeCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • ConnectNamedPipe.KERNEL32(00000000), ref: 05CD11F0
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2960310651.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_5cd0000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ConnectNamedPipe
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2191148154-0
                                                                                                                                                                      • Opcode ID: 92742bca458c285748b48a795fda62fe3fe46ee1b79a37558a3695a13d177245
                                                                                                                                                                      • Instruction ID: 473d305e9bb1b731534a8e837f14d67c4e9c01a6326658be86a4320d1b66cc7f
                                                                                                                                                                      • Opcode Fuzzy Hash: 92742bca458c285748b48a795fda62fe3fe46ee1b79a37558a3695a13d177245
                                                                                                                                                                      • Instruction Fuzzy Hash: 9C2100B1D10218DFCB24CFAAC984B9EBBF5BF08300F14845AE959A7354CB359940CF60
                                                                                                                                                                      Function 05CD1178 Relevance: 1.6, APIs: 1, Instructions: 65pipeCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • ConnectNamedPipe.KERNEL32(00000000), ref: 05CD11F0
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2960310651.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_5cd0000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ConnectNamedPipe
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2191148154-0
                                                                                                                                                                      • Opcode ID: 5cb3eaeed342a78495c12df05982c8466faf90b40bb377fe17f392a75f5e3e5a
                                                                                                                                                                      • Instruction ID: f14830452332f20488e8da39bb7ae9810ad481dac603e47bba9af31c9560dbe7
                                                                                                                                                                      • Opcode Fuzzy Hash: 5cb3eaeed342a78495c12df05982c8466faf90b40bb377fe17f392a75f5e3e5a
                                                                                                                                                                      • Instruction Fuzzy Hash: 212115B0D102589FCB14CF9AC584B9EFBF5BF48300F14846AE959A7350CB759945CFA0
                                                                                                                                                                      Function 05CD1A8C Relevance: 1.6, APIs: 1, Instructions: 59pipeCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • WaitNamedPipeW.KERNEL32(00000000,0000000A,?,?,?,?,?,?,?,05CD2986), ref: 05CD2A2F
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2960310651.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_5cd0000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: NamedPipeWait
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3146367894-0
                                                                                                                                                                      • Opcode ID: e4afb3b28fef4e8bd4a096cbd7dabbb4e06d5ddcbf88a776d237a8a1e9d5253c
                                                                                                                                                                      • Instruction ID: a8035e16574ea1334d82114027bcb200226e5435daae9eebca2aee97f9781c31
                                                                                                                                                                      • Opcode Fuzzy Hash: e4afb3b28fef4e8bd4a096cbd7dabbb4e06d5ddcbf88a776d237a8a1e9d5253c
                                                                                                                                                                      • Instruction Fuzzy Hash: 0F2127B58002098FDB20CF9AC444AEEFBF4FB48324F10882ED959A7351C779A945CFA1
                                                                                                                                                                      Function 05CD29C1 Relevance: 1.6, APIs: 1, Instructions: 55pipeCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • WaitNamedPipeW.KERNEL32(00000000,0000000A,?,?,?,?,?,?,?,05CD2986), ref: 05CD2A2F
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2960310651.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_5cd0000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: NamedPipeWait
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3146367894-0
                                                                                                                                                                      • Opcode ID: 7a090f41c8b09318b2db618d6ba810ccdd9825610edcd9fb085b46ecb2987bf0
                                                                                                                                                                      • Instruction ID: c145da6f38ef14002bfcf8f5f946c14e8dbe40673886d2a4aa31ada5b8135d28
                                                                                                                                                                      • Opcode Fuzzy Hash: 7a090f41c8b09318b2db618d6ba810ccdd9825610edcd9fb085b46ecb2987bf0
                                                                                                                                                                      • Instruction Fuzzy Hash: 832115B68002098FCB10CF99C5446EEFBB4EB48314F14881ED559A7251C738A545CFA0
                                                                                                                                                                      Function 0136D670 Relevance: .1, Instructions: 75COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2931212678.000000000136D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0136D000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_136d000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 049ebcc70a6a5ffccf9d60aafbf814afa91c3c26ef8179b27ab22a24acea6338
                                                                                                                                                                      • Instruction ID: 656fae5f42be326b28b9d94a3e46075944f7f8e56115e24bb51a0727969f2e38
                                                                                                                                                                      • Opcode Fuzzy Hash: 049ebcc70a6a5ffccf9d60aafbf814afa91c3c26ef8179b27ab22a24acea6338
                                                                                                                                                                      • Instruction Fuzzy Hash: E5216AB1600244DFCB01DF54D9C0B17BF69FB88328F20C169D8490B25AC33AD845CBA2
                                                                                                                                                                      Function 0136D66B Relevance: .1, Instructions: 56COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2931212678.000000000136D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0136D000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_136d000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
                                                                                                                                                                      • Instruction ID: 612cb648cbdf35ca52df0fc841bacec0589c57927b271907db9c0cdca8d29bc1
                                                                                                                                                                      • Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
                                                                                                                                                                      • Instruction Fuzzy Hash: 97110376504280CFCB12CF54D9C4B16BF72FB88324F24C2A9D8490B25BC33AD45ACBA2
                                                                                                                                                                      Function 0136D01D Relevance: .0, Instructions: 45COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2931212678.000000000136D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0136D000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_136d000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: a9ad6ab37bc4d022ac1a1d74aead5711e07dfd0562a0f8ef24218097469c6fbf
                                                                                                                                                                      • Instruction ID: 025aad64ad7301249aa910259b344ce6d7674d2042ae90f01c0968a99da824dd
                                                                                                                                                                      • Opcode Fuzzy Hash: a9ad6ab37bc4d022ac1a1d74aead5711e07dfd0562a0f8ef24218097469c6fbf
                                                                                                                                                                      • Instruction Fuzzy Hash: 4A012B312083449AE7114A69CD84B67BF9CEF813A8F18C42AED880B29AC379D841C6B1
                                                                                                                                                                      Function 0136D01C Relevance: .0, Instructions: 36COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000007.00000002.2931212678.000000000136D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0136D000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_7_2_136d000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: f1e1d8767cfbe95fd8c168b835069d6f4197b82be86f3c9b37e1c1759a0ba4e8
                                                                                                                                                                      • Instruction ID: 5a1dbcb89bd24aa3d87b84e47ec0d0abd7fadc366d3070e0bbaa64305180b448
                                                                                                                                                                      • Opcode Fuzzy Hash: f1e1d8767cfbe95fd8c168b835069d6f4197b82be86f3c9b37e1c1759a0ba4e8
                                                                                                                                                                      • Instruction Fuzzy Hash: 27F0C8711043449EE7118A19CC84B63FF9CEB41368F18C45AED880E29AC3759840CAB0

                                                                                                                                                                      Execution Graph

                                                                                                                                                                      Execution Coverage:12.5%
                                                                                                                                                                      Dynamic/Decrypted Code Coverage:100%
                                                                                                                                                                      Signature Coverage:0%
                                                                                                                                                                      Total number of Nodes:5
                                                                                                                                                                      Total number of Limit Nodes:1
                                                                                                                                                                      execution_graph 17957 7ffd9b408014 17959 7ffd9b40801d 17957->17959 17958 7ffd9b408082 17959->17958 17960 7ffd9b4080f6 SetProcessMitigationPolicy 17959->17960 17961 7ffd9b408152 17960->17961

                                                                                                                                                                      Executed Functions

                                                                                                                                                                      Function 00007FFD9B716991 Relevance: 1.2, Instructions: 1170COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: a9e0b3b9154711d1589a247c09cad1dc5aa3ab4de21564ae723d16dad055266c
                                                                                                                                                                      • Instruction ID: 2f358355d78cd9b27b6707f65bfd5d6645fb068b26194524f69e5dcbe8466262
                                                                                                                                                                      • Opcode Fuzzy Hash: a9e0b3b9154711d1589a247c09cad1dc5aa3ab4de21564ae723d16dad055266c
                                                                                                                                                                      • Instruction Fuzzy Hash: 59823571B1EB4E4BEBB99BA884717B973D2EF94340F160279D44DC71F2DD28AA058350
                                                                                                                                                                      Function 00007FFD9B71704B Relevance: .9, Instructions: 888COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 2994fd15361ac5c20e3441fda1a07aa78e95ce93fbfab0a2046c57c52534af77
                                                                                                                                                                      • Instruction ID: 2cdeb5879c74f9e441e62f859d2642d396a1cbc4667f85d21b959c5082f1edc6
                                                                                                                                                                      • Opcode Fuzzy Hash: 2994fd15361ac5c20e3441fda1a07aa78e95ce93fbfab0a2046c57c52534af77
                                                                                                                                                                      • Instruction Fuzzy Hash: 13522471B1EB4A5FEBA8EB688465B7977D1EF94300F01067DE04EC32B2DE28B9418751
                                                                                                                                                                      Function 00007FFD9B716BA4 Relevance: .4, Instructions: 438COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 376cf1f08a59a24cb4a5529e11f7d59285d5f8d81dbb019aa565280393bf644e
                                                                                                                                                                      • Instruction ID: dc0e00b899ce0879b3897970ba1201043c739f4d993be16ca3d0e437fc4b8f6c
                                                                                                                                                                      • Opcode Fuzzy Hash: 376cf1f08a59a24cb4a5529e11f7d59285d5f8d81dbb019aa565280393bf644e
                                                                                                                                                                      • Instruction Fuzzy Hash: 60E12471B1EB4F4AEBB99BA844717B976D2EF94304F160278D05DC31F6DE28BA018250
                                                                                                                                                                      Function 00007FFD9B71000C Relevance: 1.8, Strings: 1, Instructions: 525COMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: _
                                                                                                                                                                      • API String ID: 0-701932520
                                                                                                                                                                      • Opcode ID: 3e51f2c029378240249ba847fea45c41f4fc2026cb2316f57e6a9179901d997a
                                                                                                                                                                      • Instruction ID: b724523d2bfb5c43ff9fe7c451a1c426ddbeb75f648a3bbfa61a513104d14ef8
                                                                                                                                                                      • Opcode Fuzzy Hash: 3e51f2c029378240249ba847fea45c41f4fc2026cb2316f57e6a9179901d997a
                                                                                                                                                                      • Instruction Fuzzy Hash: 5D02A03560E7498FDB99EF2CC4B0AA077E1FF55704B2506EAD099CF1A7CA29E842C750
                                                                                                                                                                      Function 00007FFD9B7100D3 Relevance: 1.7, Strings: 1, Instructions: 475COMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: _
                                                                                                                                                                      • API String ID: 0-701932520
                                                                                                                                                                      • Opcode ID: ab8b7ea8a5a45a841dc4069d727964820b49f9099de9b549272b61fc5c1f1beb
                                                                                                                                                                      • Instruction ID: b1fbf85af08bc7c4d7ddf1dc45b38ebd30171625f182d1b482b6ebeecfd4ea1d
                                                                                                                                                                      • Opcode Fuzzy Hash: ab8b7ea8a5a45a841dc4069d727964820b49f9099de9b549272b61fc5c1f1beb
                                                                                                                                                                      • Instruction Fuzzy Hash: F9F15D3560EB098FDB9CEF6CC0A1AA573E1FF55708B2506A9D059CF1A7DE25E842CB40
                                                                                                                                                                      Function 00007FFD9B7100F2 Relevance: 1.7, Strings: 1, Instructions: 467COMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 325 7ffd9b7100f2-7ffd9b7100f8 326 7ffd9b710132 325->326 327 7ffd9b7100fa 325->327 330 7ffd9b7100cf-7ffd9b7100d1 326->330 331 7ffd9b710134-7ffd9b71014d 326->331 328 7ffd9b710097-7ffd9b7100c8 327->328 329 7ffd9b7100fc-7ffd9b7100fd 327->329 328->330 333 7ffd9b7100ff-7ffd9b710115 329->333 332 7ffd9b710116-7ffd9b710130 330->332 344 7ffd9b71014f-7ffd9b710162 331->344 332->326 333->332 344->333 346 7ffd9b710164-7ffd9b710165 344->346 347 7ffd9b710167-7ffd9b7101b2 346->347 347->344 354 7ffd9b7101b4-7ffd9b7101b5 347->354 355 7ffd9b7101b7-7ffd9b7101ca 354->355 355->347 357 7ffd9b7101cc-7ffd9b71021a 355->357 357->355 361 7ffd9b71021c-7ffd9b7151e6 357->361 368 7ffd9b7151e9-7ffd9b715217 361->368 370 7ffd9b71521a-7ffd9b715246 368->370 371 7ffd9b715271-7ffd9b7152a4 370->371 372 7ffd9b715248-7ffd9b715269 370->372 373 7ffd9b7153e4-7ffd9b715413 371->373 374 7ffd9b7152aa-7ffd9b7152b9 371->374 372->371 375 7ffd9b715464-7ffd9b715478 373->375 376 7ffd9b715415-7ffd9b71541f call 7ffd9b7146b8 373->376 377 7ffd9b7152c4-7ffd9b7152c6 374->377 379 7ffd9b7154a8-7ffd9b7154b3 375->379 380 7ffd9b71547a-7ffd9b715484 375->380 376->375 384 7ffd9b715421-7ffd9b715433 376->384 377->373 381 7ffd9b7152cc-7ffd9b715386 377->381 380->379 383 7ffd9b715486-7ffd9b715497 380->383 381->373 398 7ffd9b715388-7ffd9b715398 381->398 383->379 388 7ffd9b715499-7ffd9b7154a1 383->388 384->375 387 7ffd9b715435-7ffd9b71545f call 7ffd9b714948 384->387 387->375 388->379 398->373 399 7ffd9b71539a-7ffd9b7153df call 7ffd9b714938 398->399 399->373
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: _
                                                                                                                                                                      • API String ID: 0-701932520
                                                                                                                                                                      • Opcode ID: 3004a9ae7ecfb4c624487c6431051932ac8c515ba8c2c32891dacde46c4742f6
                                                                                                                                                                      • Instruction ID: 3b8698fa1b6b46f4b94e243d38091f34b1cc96142cd1e21ae2c0b2552c8de137
                                                                                                                                                                      • Opcode Fuzzy Hash: 3004a9ae7ecfb4c624487c6431051932ac8c515ba8c2c32891dacde46c4742f6
                                                                                                                                                                      • Instruction Fuzzy Hash: 34F15D3560EB098FDB9CEF6CD0A1AA173E1FF55708B2506A9D059CF1A7DE25E842CB40
                                                                                                                                                                      Function 00007FFD9B710088 Relevance: 1.7, Strings: 1, Instructions: 457COMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: _
                                                                                                                                                                      • API String ID: 0-701932520
                                                                                                                                                                      • Opcode ID: f61b5c0ae407f952bb2b16f0b386f1ddbaeb3538456dae753f96fba04b1675aa
                                                                                                                                                                      • Instruction ID: 938df371531eefe29cd6845ce825f79d81e3660e86c9406da6daeb6e6d95dcee
                                                                                                                                                                      • Opcode Fuzzy Hash: f61b5c0ae407f952bb2b16f0b386f1ddbaeb3538456dae753f96fba04b1675aa
                                                                                                                                                                      • Instruction Fuzzy Hash: 13E14E3560EB098FDB9CEF6CC0A1AA573E1FF55708B2506A9D059CF1A7DA25E842CB40
                                                                                                                                                                      Function 00007FFD9B408014 Relevance: 1.7, APIs: 1, Instructions: 179COMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      APIs
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2962080452.00007FFD9B400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B400000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b400000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: MitigationPolicyProcess
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1088084561-0
                                                                                                                                                                      • Opcode ID: e4cb066108b33e2058a4569fa261111ba7ecb0d35ba94ffa2740c638d61d3c39
                                                                                                                                                                      • Instruction ID: 714881924d32715a2a5891c066dca5d522d9f99b45662bd917f3b41c2df1867e
                                                                                                                                                                      • Opcode Fuzzy Hash: e4cb066108b33e2058a4569fa261111ba7ecb0d35ba94ffa2740c638d61d3c39
                                                                                                                                                                      • Instruction Fuzzy Hash: 1C514B31D1DB594FDB28AFA8D84A5E97BE0EF55310F04017FE089C3192DF68A846CB92
                                                                                                                                                                      Function 00007FFD9B71BF6C Relevance: 1.4, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 751 7ffd9b71bf6c-7ffd9b71bf85 753 7ffd9b71bf8a-7ffd9b71bf8f 751->753 754 7ffd9b71bf95-7ffd9b71bfca 753->754 755 7ffd9b71c089-7ffd9b71c0a1 753->755 754->753 766 7ffd9b71c057-7ffd9b71c06b 754->766 762 7ffd9b71c0a3-7ffd9b71c0a5 755->762 763 7ffd9b71c0a6-7ffd9b71c0ba 755->763 762->763 763->766 767 7ffd9b71c0bc-7ffd9b71c0da 763->767 768 7ffd9b71c074-7ffd9b71c075 766->768 770 7ffd9b71c077 767->770 771 7ffd9b71c0dc-7ffd9b71c0fd 767->771 768->770 772 7ffd9b71c081-7ffd9b71c088 770->772 773 7ffd9b71c079-7ffd9b71c07a 770->773 773->772
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: H
                                                                                                                                                                      • API String ID: 0-2852464175
                                                                                                                                                                      • Opcode ID: f55c1053ead7e12ca67bbd521a25559198d6f88727f9bf2703f2574da72443d1
                                                                                                                                                                      • Instruction ID: 73b7844251f7ccbfe96951ce407ec57e2373d7117b88aa6a593560c2a0186be6
                                                                                                                                                                      • Opcode Fuzzy Hash: f55c1053ead7e12ca67bbd521a25559198d6f88727f9bf2703f2574da72443d1
                                                                                                                                                                      • Instruction Fuzzy Hash: F4312B21B1EBC90FE75697B898B59A47BA0EF52210B0842FFE189CB1F7CD19A9058311
                                                                                                                                                                      Function 00007FFD9B71B54C Relevance: 1.3, Strings: 1, Instructions: 39COMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 804 7ffd9b71b54c-7ffd9b71b579 806 7ffd9b71b584-7ffd9b71b5a7 804->806
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: H
                                                                                                                                                                      • API String ID: 0-2852464175
                                                                                                                                                                      • Opcode ID: 1cd667b4479263264dbe5fc3c3e09555fccebd2a87f1492e477d9a690d194394
                                                                                                                                                                      • Instruction ID: bf7cba85e13e49ab8e37afcc83c9cf3fa44723e0bf8eddea6147d5d7f5a0e580
                                                                                                                                                                      • Opcode Fuzzy Hash: 1cd667b4479263264dbe5fc3c3e09555fccebd2a87f1492e477d9a690d194394
                                                                                                                                                                      • Instruction Fuzzy Hash: 05F0282260DA9E4BDBA8DF088494A6477A1EFA4740F0407F9D008D729ADD20FD458780
                                                                                                                                                                      Function 00007FFD9B712666 Relevance: .5, Instructions: 527COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: b4893542e2af242e98bf04bfe4b815bbe3cb90cd7ef2ed7944e40f5df01855f6
                                                                                                                                                                      • Instruction ID: 283144f4d41bddd9f722a34530222fa115c39df42653c46b1d93a33974b7d03d
                                                                                                                                                                      • Opcode Fuzzy Hash: b4893542e2af242e98bf04bfe4b815bbe3cb90cd7ef2ed7944e40f5df01855f6
                                                                                                                                                                      • Instruction Fuzzy Hash: 7CF10972B1DF4E4BE7A8DB5884A5AB573D2FFA47407050279D40EC31B6EE25F9028350
                                                                                                                                                                      Function 00007FFD9B7101D3 Relevance: .4, Instructions: 420COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 565fa96abc56b838371674e8d1ae105479791068c44336ab313d52d408d86428
                                                                                                                                                                      • Instruction ID: b180093112d9a0e067bb8f54c60d1a1db13ea73a918827293f5678c9da669491
                                                                                                                                                                      • Opcode Fuzzy Hash: 565fa96abc56b838371674e8d1ae105479791068c44336ab313d52d408d86428
                                                                                                                                                                      • Instruction Fuzzy Hash: FAE12C3560EB098FDBDCEE5CC0A1AA573E1FF64704B2506A9D059CB2A7CA25F942CB40
                                                                                                                                                                      Function 00007FFD9B710252 Relevance: .4, Instructions: 405COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: a278ceef8d945b3fc284d4c3d825f2e22dafc790806ccf43cf4934e21818d296
                                                                                                                                                                      • Instruction ID: 20d1acf478c5d4927a186787ea40951b872607a447a21acde4a46e6841834b73
                                                                                                                                                                      • Opcode Fuzzy Hash: a278ceef8d945b3fc284d4c3d825f2e22dafc790806ccf43cf4934e21818d296
                                                                                                                                                                      • Instruction Fuzzy Hash: 50D11C3560DB098FDBDCEE5CC4A1AA173E1FF64704B250AA9D059CF2A7CA25F942CB50
                                                                                                                                                                      Function 00007FFD9B7192BC Relevance: .4, Instructions: 394COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: f0fe06ecdc647660dd512e1e75109f52371d87d4b76bf11d01b07c8f99dfc8b9
                                                                                                                                                                      • Instruction ID: 05157f0f43715f08b6e05b181df932abc3d7fd1a49d1059f69aef6c5a5e533b5
                                                                                                                                                                      • Opcode Fuzzy Hash: f0fe06ecdc647660dd512e1e75109f52371d87d4b76bf11d01b07c8f99dfc8b9
                                                                                                                                                                      • Instruction Fuzzy Hash: 5FC10931B0EB4E4FEBA5DB6888697B537D1EF98700F1502B9E45DC32E2DE25AD028741
                                                                                                                                                                      Function 00007FFD9B7151BD Relevance: .4, Instructions: 361COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 5370d96722fa91d327b4342f96b4e735fc2495423e76ff0fd3ad8422c66cf249
                                                                                                                                                                      • Instruction ID: f555a4abd1fb3d308f83bf790c76371a4313fdda72d14393c5b05d71fdf017a6
                                                                                                                                                                      • Opcode Fuzzy Hash: 5370d96722fa91d327b4342f96b4e735fc2495423e76ff0fd3ad8422c66cf249
                                                                                                                                                                      • Instruction Fuzzy Hash: A7C1C034719B098FDBDCEF58C0A5B6573E2FF64304B650AADD059CB29BCA25E942CB40
                                                                                                                                                                      Function 00007FFD9B7156C9 Relevance: .3, Instructions: 314COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 36012bb612020a6b5dd998f8d03a1bfe7bc194cb675d7a64723d120b22525611
                                                                                                                                                                      • Instruction ID: 2ec0d9e02f8bca2e329009369d34872f144dd99376b5c034475511f2495e2df2
                                                                                                                                                                      • Opcode Fuzzy Hash: 36012bb612020a6b5dd998f8d03a1bfe7bc194cb675d7a64723d120b22525611
                                                                                                                                                                      • Instruction Fuzzy Hash: ED913932A0EB4E4FEB6CEA6884A25B577E1EF61310715037AC44DC71F2EE15B906C7A0
                                                                                                                                                                      Function 00007FFD9B71BC55 Relevance: .3, Instructions: 283COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: b3fa6dab46faef3186bd00a602119c7e6ec9ac973a8780032b09e0173957f9e2
                                                                                                                                                                      • Instruction ID: b4670838aeaf2876f2dc87d7433eeb06b2da8ffa39c37134751fc382f1645559
                                                                                                                                                                      • Opcode Fuzzy Hash: b3fa6dab46faef3186bd00a602119c7e6ec9ac973a8780032b09e0173957f9e2
                                                                                                                                                                      • Instruction Fuzzy Hash: 25814421B1DF4E0FEB99EB6C8865A7577E1EFA4300B1402BAD44CC72F6DE25A9418381
                                                                                                                                                                      Function 00007FFD9B71CC27 Relevance: .2, Instructions: 223COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 45e2428fac3fdaf14e047ad385be867a6a03938a92098245549601ec44cfa4c2
                                                                                                                                                                      • Instruction ID: 68e375a896c4e37d66116b9081e33615a6010b524fcfdf69dc3f41361522f650
                                                                                                                                                                      • Opcode Fuzzy Hash: 45e2428fac3fdaf14e047ad385be867a6a03938a92098245549601ec44cfa4c2
                                                                                                                                                                      • Instruction Fuzzy Hash: 2D616923B19B5A0FE758FBEC94F2AE977A1EF4421471502B2D088CB1F7EC18A9464290
                                                                                                                                                                      Function 00007FFD9B716C2C Relevance: .2, Instructions: 204COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: e9bf1866d998f109c499118eb6cc0b5dab6fc9d8f5a42c24480074847418bb4f
                                                                                                                                                                      • Instruction ID: 4534119f434151193c173810bae1db3d9b4b631d252185865ae655a376fe5367
                                                                                                                                                                      • Opcode Fuzzy Hash: e9bf1866d998f109c499118eb6cc0b5dab6fc9d8f5a42c24480074847418bb4f
                                                                                                                                                                      • Instruction Fuzzy Hash: 0B614472B1EB8F0AEFB99BA844707B576D1EF54300F0612BDD49E861F6DE18F9018260
                                                                                                                                                                      Function 00007FFD9B712764 Relevance: .2, Instructions: 188COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: a1bfb42bda896ed8c3879c851bee235f25ee04399dc4fa0b207cd54a7cb8de3d
                                                                                                                                                                      • Instruction ID: e4c0412ae97b4bc76571d9250d7830173d70f25d38abe0d64902fab76cb9ac90
                                                                                                                                                                      • Opcode Fuzzy Hash: a1bfb42bda896ed8c3879c851bee235f25ee04399dc4fa0b207cd54a7cb8de3d
                                                                                                                                                                      • Instruction Fuzzy Hash: 0C51F27260DB494FEB98EF68C460BA577D1FF68314B0502B9D48DCB2A2DE25F846CB50
                                                                                                                                                                      Function 00007FFD9B7110E0 Relevance: .2, Instructions: 183COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 4eafc224ea0c664a1f1593e2da137322addf6deb89989fc4db147139c1d97fb2
                                                                                                                                                                      • Instruction ID: c2f6d465a4fcaf3384f5dd88db05d11ae2b37c4dfc1f285f30aa5ec96bd5e010
                                                                                                                                                                      • Opcode Fuzzy Hash: 4eafc224ea0c664a1f1593e2da137322addf6deb89989fc4db147139c1d97fb2
                                                                                                                                                                      • Instruction Fuzzy Hash: F2513A53F0F7DA0FE716AB7C64B65E57BA1FF42624B0902B7C0988F0B3DD1468468261
                                                                                                                                                                      Function 00007FFD9B7160E9 Relevance: .2, Instructions: 165COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 7251b6d07a44f9eafef1476b04f3c6b308e625928492722e7280006f37217571
                                                                                                                                                                      • Instruction ID: 16e6949d53251d45516d00a06e90c82ead734df7f36c310bacce30ca86fc4eb0
                                                                                                                                                                      • Opcode Fuzzy Hash: 7251b6d07a44f9eafef1476b04f3c6b308e625928492722e7280006f37217571
                                                                                                                                                                      • Instruction Fuzzy Hash: 86518071709B8D8FDB98DF28C8A0AA537A1FF58314B1512ADD45EC72E2DB35E942CB40
                                                                                                                                                                      Function 00007FFD9B71CCFB Relevance: .2, Instructions: 164COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: c259b4d6e71ac5152d9c477cd0b5837e46b9a5ba757bdfdb133b4c1fdd5caa5c
                                                                                                                                                                      • Instruction ID: 8c6494e955f7b92e9cc1d507d85f62640a86d7c9b93f7edc9614c78b5ede097c
                                                                                                                                                                      • Opcode Fuzzy Hash: c259b4d6e71ac5152d9c477cd0b5837e46b9a5ba757bdfdb133b4c1fdd5caa5c
                                                                                                                                                                      • Instruction Fuzzy Hash: A6419E11B1EB8E0FE759E7BC48F5AB57BE1EF5520471502B6E048C72E7ED14A8454381
                                                                                                                                                                      Function 00007FFD9B713F38 Relevance: .2, Instructions: 161COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 0d3f3453755d09e1127d1881593c03581ae6cbbdeedcee98cb3df83975949520
                                                                                                                                                                      • Instruction ID: e7308392f189f0cdf7f42592f1f1ea33628c1968fa0ebbeb4400ed0dad884d61
                                                                                                                                                                      • Opcode Fuzzy Hash: 0d3f3453755d09e1127d1881593c03581ae6cbbdeedcee98cb3df83975949520
                                                                                                                                                                      • Instruction Fuzzy Hash: F3510635719F0A8FDBDCEF58C09076173A1FF683047254AADC05DCB69ADA25E846CB50
                                                                                                                                                                      Function 00007FFD9B7193A6 Relevance: .1, Instructions: 136COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 1cf7f532944f02e673a56d37e6a121ca7d3caf761ba2d60559edb29ad30f3e6b
                                                                                                                                                                      • Instruction ID: 224aeb2fe82bc6375eb6c20a52220335f46506386f1c73c473cd95061233bcda
                                                                                                                                                                      • Opcode Fuzzy Hash: 1cf7f532944f02e673a56d37e6a121ca7d3caf761ba2d60559edb29ad30f3e6b
                                                                                                                                                                      • Instruction Fuzzy Hash: 2C41E471B0AB8E4FEBA5DB6C88687B53BA1EF94740F5501BDD44CC72B2DE25A902C701
                                                                                                                                                                      Function 00007FFD9B714461 Relevance: .1, Instructions: 133COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 2950915a039c89d5fd76d08d571483cfeda055cffba372d71777c02da8a92a52
                                                                                                                                                                      • Instruction ID: d7a265fa9467391f1095cb63cf0d8d3c4ab28f49d0364c3041040407e5fa1bf3
                                                                                                                                                                      • Opcode Fuzzy Hash: 2950915a039c89d5fd76d08d571483cfeda055cffba372d71777c02da8a92a52
                                                                                                                                                                      • Instruction Fuzzy Hash: 6A312922B0AF4D0FE7A4EA6C44A577477D2EFA5340B0502BED40DC71B7ED15AD054750
                                                                                                                                                                      Function 00007FFD9B71D9C2 Relevance: .1, Instructions: 131COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 0f2e572d0f121fdeffee0d486dd4436f0038d4f046e55fec61c18a892a48a506
                                                                                                                                                                      • Instruction ID: a699abaed5332230d549d35b6f7d92d32e9882a1f45c351e70f6c3b47bbfe7e9
                                                                                                                                                                      • Opcode Fuzzy Hash: 0f2e572d0f121fdeffee0d486dd4436f0038d4f046e55fec61c18a892a48a506
                                                                                                                                                                      • Instruction Fuzzy Hash: 3641CA31E09B1D4FE7A4EBA8C4A97A477E1EF54300F4146B9D10DE72F2DE38A9458B50
                                                                                                                                                                      Function 00007FFD9B711327 Relevance: .1, Instructions: 127COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 4bae93a7661456b43e9dd930680ed298da62ea637e74b8787465cf1550d7b9b9
                                                                                                                                                                      • Instruction ID: 28dff8f5348c2972767c51c55999a8107ea3f0b48bb19547a9c54d217e2b8bc2
                                                                                                                                                                      • Opcode Fuzzy Hash: 4bae93a7661456b43e9dd930680ed298da62ea637e74b8787465cf1550d7b9b9
                                                                                                                                                                      • Instruction Fuzzy Hash: BD41806390F7A94FD712AB7CA8754E53B60EF0262870903F7D0998F4B7ED1478868691
                                                                                                                                                                      Function 00007FFD9B71BFCE Relevance: .1, Instructions: 122COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: ecb2c08ed9deecd405ff76e463f737788fdb6f14e41f442d5bf9fd68b59a387c
                                                                                                                                                                      • Instruction ID: 08b674e639479a74e798acefb8cc2db3486160b833a17ab9b143a495bf4034d5
                                                                                                                                                                      • Opcode Fuzzy Hash: ecb2c08ed9deecd405ff76e463f737788fdb6f14e41f442d5bf9fd68b59a387c
                                                                                                                                                                      • Instruction Fuzzy Hash: A8315A12B1FB9A0FE79687B85CB5AB43BA0EF5125070A43FBD089CB0F3DD08A9058351
                                                                                                                                                                      Function 00007FFD9B71B5AA Relevance: .1, Instructions: 118COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 9b79a6f81489bc94013135540a3c57a99dcc761bd4ff128bae109258e844bd04
                                                                                                                                                                      • Instruction ID: 837dbb344f7a1f385754689ac49590f0a8c4e038437911f27696fa6950920172
                                                                                                                                                                      • Opcode Fuzzy Hash: 9b79a6f81489bc94013135540a3c57a99dcc761bd4ff128bae109258e844bd04
                                                                                                                                                                      • Instruction Fuzzy Hash: AC314B32B1E78E4FD7689B5898656F43790EF54310F0102BED04EC32B2DD25790B8651
                                                                                                                                                                      Function 00007FFD9B7103F8 Relevance: .1, Instructions: 102COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: b82985234239f074a5c69db533ff7b5d984c3f999df2513224ecc8e6bb99762c
                                                                                                                                                                      • Instruction ID: 4424c276d03be885ce1b70691053cc81c0c631cdf1e3c2411cf40d917ab15b72
                                                                                                                                                                      • Opcode Fuzzy Hash: b82985234239f074a5c69db533ff7b5d984c3f999df2513224ecc8e6bb99762c
                                                                                                                                                                      • Instruction Fuzzy Hash: 54219383A1F7D60EE366967828B51E03FA0EF1396470A12FBD498DE0F3EC4969464361
                                                                                                                                                                      Function 00007FFD9B71DA6B Relevance: .1, Instructions: 99COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 9fbdae11a07fbbbd71acd8950c06295dc4a421ddb896cbabfae7a1d745f36d0f
                                                                                                                                                                      • Instruction ID: a980b08e3bcecadfa7bda92fbb6b5244c3b97ddd28a18f80b1f7f07cdd12f324
                                                                                                                                                                      • Opcode Fuzzy Hash: 9fbdae11a07fbbbd71acd8950c06295dc4a421ddb896cbabfae7a1d745f36d0f
                                                                                                                                                                      • Instruction Fuzzy Hash: B7317E71A05A1D8FEBE4EB98C4A87A477E1FB58300F4146B9D50DE72B1CE34AD819B00
                                                                                                                                                                      Function 00007FFD9B714E59 Relevance: .1, Instructions: 97COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: ff63d92f9fb05a45167aa0aa80f8171913f4b7dc4d94877777f481027c43a985
                                                                                                                                                                      • Instruction ID: 6530e7906c43de79fb33cedd0b78c9f12e78efc284fcc007916cfab19c0bdfb8
                                                                                                                                                                      • Opcode Fuzzy Hash: ff63d92f9fb05a45167aa0aa80f8171913f4b7dc4d94877777f481027c43a985
                                                                                                                                                                      • Instruction Fuzzy Hash: ED21B622A0E79A4FE776966884753747AE19F52340F0A86BEC089C71F2CD1C9A4A8721
                                                                                                                                                                      Function 00007FFD9B717917 Relevance: .1, Instructions: 97COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: cb69c043234dc5926a27a972e99688c704133e5858880bc3567995400a31fd98
                                                                                                                                                                      • Instruction ID: f814097bef7002d33d1f33dcecfa399ad9161734583a361c2a3c5db023a8732a
                                                                                                                                                                      • Opcode Fuzzy Hash: cb69c043234dc5926a27a972e99688c704133e5858880bc3567995400a31fd98
                                                                                                                                                                      • Instruction Fuzzy Hash: 1A319470B4FB0F9AEB799AA880717BD71D2AF44304F565238D04EC21B1DE2CBB459650
                                                                                                                                                                      Function 00007FFD9B715961 Relevance: .1, Instructions: 96COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: ed6c27480c365780421d7b195b58feada1a3f1bf8f308a63b2cb0211c35275c8
                                                                                                                                                                      • Instruction ID: c716db5d1961a2d56efcb0fa2cabc921518e5660ce4dcf9d8061343a09bd9b7c
                                                                                                                                                                      • Opcode Fuzzy Hash: ed6c27480c365780421d7b195b58feada1a3f1bf8f308a63b2cb0211c35275c8
                                                                                                                                                                      • Instruction Fuzzy Hash: 10212432B1DF0E0AEF58EE68A492AF573E0EB11320B40163BE45A861A7DD15F9528781
                                                                                                                                                                      Function 00007FFD9B71C45A Relevance: .1, Instructions: 94COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 753b856316b86b739865fa45688c04902a88bc274a9fc2fa7dea8b01f74677fa
                                                                                                                                                                      • Instruction ID: f073c833d145d34e8f55d9d0d249bc8d6181792a5f0877db00af9a345607df2a
                                                                                                                                                                      • Opcode Fuzzy Hash: 753b856316b86b739865fa45688c04902a88bc274a9fc2fa7dea8b01f74677fa
                                                                                                                                                                      • Instruction Fuzzy Hash: 6721492170FF4D0FE7A4E7BC94A937437D2EF9924070506BAD04DC72B2DC29A8464350
                                                                                                                                                                      Function 00007FFD9B715E10 Relevance: .1, Instructions: 91COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 5a47e148d0d2b764112248ab10ab6c44e1e62c125eafce01f1387ed788f005ee
                                                                                                                                                                      • Instruction ID: 60ec6558fdc07d782df0a52874186d2cefd03c160e03f2796c6d0b4290374308
                                                                                                                                                                      • Opcode Fuzzy Hash: 5a47e148d0d2b764112248ab10ab6c44e1e62c125eafce01f1387ed788f005ee
                                                                                                                                                                      • Instruction Fuzzy Hash: 09213862E1FB8E0FE799AB6808B56A03BA1EF5550470902F7D498CF1E7DC18A9894361
                                                                                                                                                                      Function 00007FFD9B71B5BE Relevance: .1, Instructions: 89COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: baf328699ee2cf55b92eb3ce954d631f2fbfd10edc822840202464b2c5765d85
                                                                                                                                                                      • Instruction ID: 1d24fa938fa59b7ca7623cfb2ad9bbe27e6c2ef4a3806fd32f8ada2f96d848a0
                                                                                                                                                                      • Opcode Fuzzy Hash: baf328699ee2cf55b92eb3ce954d631f2fbfd10edc822840202464b2c5765d85
                                                                                                                                                                      • Instruction Fuzzy Hash: AF213A31B1EB8E4FD764DB5898656E47791FF54310F0102BED04EC32A6DD25B8068750
                                                                                                                                                                      Function 00007FFD9B717F95 Relevance: .1, Instructions: 86COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 54e7012bf9bed4bc189600229dbfea87dc18736864d0822ecb0c72d8ea94440d
                                                                                                                                                                      • Instruction ID: 76c00f18be3b95ca1f2a7f816c8a866b003758807bd0e3f55ebaabb781c6eb6f
                                                                                                                                                                      • Opcode Fuzzy Hash: 54e7012bf9bed4bc189600229dbfea87dc18736864d0822ecb0c72d8ea94440d
                                                                                                                                                                      • Instruction Fuzzy Hash: 3821E220B0EB4E4FE7B597A8807077572DAEF85340F0652B6C44DC71F2CD1CAA068360
                                                                                                                                                                      Function 00007FFD9B715E20 Relevance: .1, Instructions: 81COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 2e5f596a5a6a9971e68796abe0206a972d423ee48e3e6b00a8cd0e2dc554417e
                                                                                                                                                                      • Instruction ID: c087ea507ecce5ac0c0ebd7a16209e7d1e00898088818dc06abee7552dce2255
                                                                                                                                                                      • Opcode Fuzzy Hash: 2e5f596a5a6a9971e68796abe0206a972d423ee48e3e6b00a8cd0e2dc554417e
                                                                                                                                                                      • Instruction Fuzzy Hash: 3D213852F1FB8E0FE7999B6808B56A03BA1FF5550470602F6D498CF1F7DC18A9498361
                                                                                                                                                                      Function 00007FFD9B715E30 Relevance: .1, Instructions: 73COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: de32913923f6fb221793967286f9c43cba908704693f6ee953360ac08dbc76dd
                                                                                                                                                                      • Instruction ID: 205db36adf04006e62fe1b43d8a5ee14acde6e01015d649a1e9ad3a87ac4af8b
                                                                                                                                                                      • Opcode Fuzzy Hash: de32913923f6fb221793967286f9c43cba908704693f6ee953360ac08dbc76dd
                                                                                                                                                                      • Instruction Fuzzy Hash: 02115952F1EB8E0FE799AB6804B56A03BA1EF5550070602F6D05CCB1F7DC18A9888321
                                                                                                                                                                      Function 00007FFD9B715F7D Relevance: .1, Instructions: 71COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 3a4902e54b729a9cffd8f82f5a35d400fdedf1da3f56700d19d6117bb6c46210
                                                                                                                                                                      • Instruction ID: 196b9453fe51ab6d2a22f9b362525b120cd035ac8e54be028cc49bd7598c7cd3
                                                                                                                                                                      • Opcode Fuzzy Hash: 3a4902e54b729a9cffd8f82f5a35d400fdedf1da3f56700d19d6117bb6c46210
                                                                                                                                                                      • Instruction Fuzzy Hash: 43110672E0EB8C4FDF95DFA448B56A83FA5EF55300F0601EAD498D31B2DE21A501C711
                                                                                                                                                                      Function 00007FFD9B7125C0 Relevance: .1, Instructions: 68COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: b1c150524c4f094020f47ee0b38e738234c466d4c243b55a19175ccbc3ecbe42
                                                                                                                                                                      • Instruction ID: d18899c118b5b0ba3b2f97692e79983e3cbe8664ee9a6892b6a05fd1059e73ed
                                                                                                                                                                      • Opcode Fuzzy Hash: b1c150524c4f094020f47ee0b38e738234c466d4c243b55a19175ccbc3ecbe42
                                                                                                                                                                      • Instruction Fuzzy Hash: 1711A271709B4A4FDB98DE58C8A4A6473D2FFA8704B0505BDD45EC72A2DE21EC42CB40
                                                                                                                                                                      Function 00007FFD9B71DBA0 Relevance: .1, Instructions: 66COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 62b1418ae4f038b164646c5ffc91fdea5ddcf244131f39cc70f4997703a8a8a7
                                                                                                                                                                      • Instruction ID: e9cc287ec58b7558459e80d1822afef425167c80f006ba17fa3aa951adb4713a
                                                                                                                                                                      • Opcode Fuzzy Hash: 62b1418ae4f038b164646c5ffc91fdea5ddcf244131f39cc70f4997703a8a8a7
                                                                                                                                                                      • Instruction Fuzzy Hash: 5521EA71A1AA595FEFA4EB58C8A8BA477F1EF28311F4441E5D00DD31B1DE34AD808F10
                                                                                                                                                                      Function 00007FFD9B71280C Relevance: .1, Instructions: 62COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 169a0b56c53ef1e1348f27c259d975cf00b64662bcf5f74e2d0c06b972a58a3b
                                                                                                                                                                      • Instruction ID: 0ae85517f4f2774c8f81751867671bb9cac341e3751980063cae5dafaa1cee00
                                                                                                                                                                      • Opcode Fuzzy Hash: 169a0b56c53ef1e1348f27c259d975cf00b64662bcf5f74e2d0c06b972a58a3b
                                                                                                                                                                      • Instruction Fuzzy Hash: 3F11BE71B09A4D4FDB98EF68C060B6573A1FF68308B0542B8C48EDB2A7CE35F9458790
                                                                                                                                                                      Function 00007FFD9B712875 Relevance: .1, Instructions: 61COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 0e99cea87c0e2ae1adf6a7361edaba0e388416df0edbc66925741ce0de3df00b
                                                                                                                                                                      • Instruction ID: 6ad23d7fe2ad2b8c27087c691913072e9ff72791c2336ded66fa8080da9d59e7
                                                                                                                                                                      • Opcode Fuzzy Hash: 0e99cea87c0e2ae1adf6a7361edaba0e388416df0edbc66925741ce0de3df00b
                                                                                                                                                                      • Instruction Fuzzy Hash: 8C11BE71709A494FDB98EF68C060B6173A1FF68304B0541A8C48DCB2A7CE35F9458790
                                                                                                                                                                      Function 00007FFD9B710450 Relevance: .1, Instructions: 60COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 9896b0bf5355693aa42167ffe6b942b386da74249a393896a10382ba9f5ae410
                                                                                                                                                                      • Instruction ID: e5909daa70626549f76ab0eccc98a92e5ec65e251ffbbc86e8df3635d2d4bc5a
                                                                                                                                                                      • Opcode Fuzzy Hash: 9896b0bf5355693aa42167ffe6b942b386da74249a393896a10382ba9f5ae410
                                                                                                                                                                      • Instruction Fuzzy Hash: 7E019643A1F7C90AE366967918B95B17FA0DF5796070A02FBD498DB1F3EC4828454321
                                                                                                                                                                      Function 00007FFD9B711180 Relevance: .1, Instructions: 59COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 9e00eeb5ab4ee5975c47675d51a123f5bb59c14309f046313bd474faa2471fc5
                                                                                                                                                                      • Instruction ID: 7c788d1ab8a2fb380060f3382a098a648f3e6c5d67b4b5ead8f4a53bb3d89c41
                                                                                                                                                                      • Opcode Fuzzy Hash: 9e00eeb5ab4ee5975c47675d51a123f5bb59c14309f046313bd474faa2471fc5
                                                                                                                                                                      • Instruction Fuzzy Hash: EE016D61F2AE0F0EE7ACEB6C04E5B7562D2FF986047515275E40DCB1AADC28D9854360
                                                                                                                                                                      Function 00007FFD9B71CF3D Relevance: .0, Instructions: 47COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 7aeed8bbee6db662a4eefad5880f1d2f2799678a19dc71b7cf46302a7b9042c4
                                                                                                                                                                      • Instruction ID: 837affb113a820fe08ba985012464827d0ec4c667f71335faf3e621f39366710
                                                                                                                                                                      • Opcode Fuzzy Hash: 7aeed8bbee6db662a4eefad5880f1d2f2799678a19dc71b7cf46302a7b9042c4
                                                                                                                                                                      • Instruction Fuzzy Hash: 3E115E34A08A5D8EDB69DF14C8A97A5B7F0FB94301F5002BDC119D3260DF301985DF41
                                                                                                                                                                      Function 00007FFD9B710B15 Relevance: .0, Instructions: 42COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 08adc8b170c5af1fdef508b39141cace016af1e4d18287f9090dd7fd5dfae07a
                                                                                                                                                                      • Instruction ID: 302ce79b1021b9a0b6b223e29ee0f7477c6a5c76c320a7ef613ef45046d289cd
                                                                                                                                                                      • Opcode Fuzzy Hash: 08adc8b170c5af1fdef508b39141cace016af1e4d18287f9090dd7fd5dfae07a
                                                                                                                                                                      • Instruction Fuzzy Hash: 57F0312144F3964FD36297B488A56947FF0EF46550B0E42EAD484CB4B3D94C598A87A1
                                                                                                                                                                      Function 00007FFD9B71DC32 Relevance: .0, Instructions: 40COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: f760f18dcd5bcbd1857b3d4c2cac75c7e5936f3a94d45231e1a7d5e84484f39a
                                                                                                                                                                      • Instruction ID: 7bd712e83e03df8e8a04c9b0480ac4e67ec8c651b2d2d9748eb00cde6aa8266d
                                                                                                                                                                      • Opcode Fuzzy Hash: f760f18dcd5bcbd1857b3d4c2cac75c7e5936f3a94d45231e1a7d5e84484f39a
                                                                                                                                                                      • Instruction Fuzzy Hash: 1001FB71E15A2E8EDBA4EB6884A97E8B3B1EF58301F5116FAD11DD21A1DE345AC08F00
                                                                                                                                                                      Function 00007FFD9B71DDD0 Relevance: .0, Instructions: 40COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: dd28e142ef54ae5627f3bce57bae949237afae7468ad9f8d7c6174408b6c6d68
                                                                                                                                                                      • Instruction ID: 5bdbaf176961375d06d1254f454c63e599fd0955bee0e76f5b45135da0521a07
                                                                                                                                                                      • Opcode Fuzzy Hash: dd28e142ef54ae5627f3bce57bae949237afae7468ad9f8d7c6174408b6c6d68
                                                                                                                                                                      • Instruction Fuzzy Hash: 02E09BB114E50C6EA61CAA55EC079F7379CE747134F00111FE1CE86012F152B5238295
                                                                                                                                                                      Function 00007FFD9B71CFB7 Relevance: .0, Instructions: 39COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: fff5448435020f31b445e3f3fc27183d0ba08cffd3374a4bc0eaa87662e67c05
                                                                                                                                                                      • Instruction ID: 36b99660fc0e65c1a43392aeed5db519a363349a43b7751b65e22d0089cfbbd8
                                                                                                                                                                      • Opcode Fuzzy Hash: fff5448435020f31b445e3f3fc27183d0ba08cffd3374a4bc0eaa87662e67c05
                                                                                                                                                                      • Instruction Fuzzy Hash: EF01DE74A0896C8FCF99EF18C8A9BA9B7B1FB54301F1002D9C04DE32A0CA305980CF00
                                                                                                                                                                      Function 00007FFD9B7143F9 Relevance: .0, Instructions: 35COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 0830e104f562b570cc442995f7ba518f75b4522b976e05b0b7f033b913235c99
                                                                                                                                                                      • Instruction ID: e85aa784ed8e5a754e7e25b34293c1c7714b5f3a691b64eae77070ae69d9f35b
                                                                                                                                                                      • Opcode Fuzzy Hash: 0830e104f562b570cc442995f7ba518f75b4522b976e05b0b7f033b913235c99
                                                                                                                                                                      • Instruction Fuzzy Hash: 2FF0F632A1DB8C4FD755AB34887A2A9BF71FF45200B5541FAD518C72E7EE289904C741
                                                                                                                                                                      Function 00007FFD9B713A89 Relevance: .0, Instructions: 32COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 87ee7c3fb690e3df658201784ef0b785e2721d00da932ca184c0598c8688f227
                                                                                                                                                                      • Instruction ID: 1ed82ebfaa579b418c4ad9caa09dbc9322d3b8194a887586955cf7c3c9cbbbd2
                                                                                                                                                                      • Opcode Fuzzy Hash: 87ee7c3fb690e3df658201784ef0b785e2721d00da932ca184c0598c8688f227
                                                                                                                                                                      • Instruction Fuzzy Hash: 3DF0A03140D78C9FCB42DB68D4618D5BFB0FE06310B0501C7E089CB463E7209A58CB92
                                                                                                                                                                      Function 00007FFD9B7109B1 Relevance: .0, Instructions: 28COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 509393b1ebab6bc8989296e2104fae6f76173bf340e62f5fd1ea2bae118ecbee
                                                                                                                                                                      • Instruction ID: 860667c619cb2873a00d96c5924cbc991bf9cf156da5fa5cf8c3d1b9dcd1d740
                                                                                                                                                                      • Opcode Fuzzy Hash: 509393b1ebab6bc8989296e2104fae6f76173bf340e62f5fd1ea2bae118ecbee
                                                                                                                                                                      • Instruction Fuzzy Hash: B7E0DF2150F7C40FDB539B3888AC8E13FA0EE1732030A01EBD481CF0B3E5198A89CB52
                                                                                                                                                                      Function 00007FFD9B714E70 Relevance: .0, Instructions: 24COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 70c9da49ceaf4b4147091c728dc5c13fbdf9ea432047f8e68274fe0695301e91
                                                                                                                                                                      • Instruction ID: 352aa0ccd9472b42fb4a229a84dbe7f0266a31f0d8f0e37444e31e32d3751481
                                                                                                                                                                      • Opcode Fuzzy Hash: 70c9da49ceaf4b4147091c728dc5c13fbdf9ea432047f8e68274fe0695301e91
                                                                                                                                                                      • Instruction Fuzzy Hash: A7E08C16A4E71B06FB7CA5B5A8B13B970D18F46300F4A927EE41D810E9CD6C9E848562
                                                                                                                                                                      Function 00007FFD9B71C059 Relevance: .0, Instructions: 21COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 007e7816dcfe0ae71bf2e393bd65253e1200ffdaaba5a67605bae44925e0708f
                                                                                                                                                                      • Instruction ID: 1c1085ce21ab7e69c56dd22f96a587463ebead90584da4a9a330be91ad999009
                                                                                                                                                                      • Opcode Fuzzy Hash: 007e7816dcfe0ae71bf2e393bd65253e1200ffdaaba5a67605bae44925e0708f
                                                                                                                                                                      • Instruction Fuzzy Hash: 7BE01271A1DB495FE794DB9CD4A29A5F7D0FBA8298F40067EE04DD2260DA25D6808B01
                                                                                                                                                                      Function 00007FFD9B712914 Relevance: .0, Instructions: 8COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000008.00000002.2967969475.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_8_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: a34ce74dade8cc2bd046ef67da8a542fc7d2e95807cb55681d6d839b338f8a98
                                                                                                                                                                      • Instruction ID: 2b426b4b892e66926e38079b7d152408c710202f45e844ca4b5c0168b749b047
                                                                                                                                                                      • Opcode Fuzzy Hash: a34ce74dade8cc2bd046ef67da8a542fc7d2e95807cb55681d6d839b338f8a98
                                                                                                                                                                      • Instruction Fuzzy Hash: 8DC09B10F1E64E46F364EFA8C47567D21526FCC208B564535D04D8A1A6CD3C67016545