Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
NotaFiscalOnline.ClientSetup.ex#.exe

Overview

General Information

Sample name:NotaFiscalOnline.ClientSetup.ex#.exe
Analysis ID:1579141
MD5:6172d1fc5570bc73675ba4dd05772a6e
SHA1:407aa98fe89d23a8b0fd3b9f448ee11bcf028c41
SHA256:564370d9522a479a4ed5c2a9b18f66e289e51e2dbf3ce3920fc3e0ad99e25046
Tags:exeuser-500mk500
Infos:

Detection

ScreenConnect Tool
Score:66
Range:0 - 100
Whitelisted:false
Confidence:100%

Compliance

Score:33
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
AI detected suspicious sample
Contains functionality to hide user accounts
Detected potential unwanted application
Enables network access during safeboot for specific services
Modifies security policies related information
Possible COM Object hijacking
Reads the Security eventlog
Reads the System eventlog
Allocates memory with a write watch (potentially for evading sandboxes)
Checks for available system drives (often done to infect USB drives)
Contains functionality to detect virtual machines (SGDT)
Contains functionality to detect virtual machines (SLDT)
Contains functionality to launch a process as a different user
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates or modifies windows services
Deletes files inside the Windows folder
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
EXE planting / hijacking vulnerabilities found
Enables debug privileges
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
May sleep (evasive loops) to hinder dynamic analysis
May use bcdedit to modify the Windows boot settings
Modifies existing windows services
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected ScreenConnect Tool

Classification

Process Tree

  • System is w10x64
  • NotaFiscalOnline.ClientSetup.ex#.exe (PID: 6652 cmdline: "C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exe" MD5: 6172D1FC5570BC73675BA4DD05772A6E)
    • msiexec.exe (PID: 1748 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ScreenConnect\24.3.7.9067\bc180d8c7278c2c2\ScreenConnect.ClientSetup.msi" MD5: 9D09DC1EDA745A5F87553048E57620CF)
  • msiexec.exe (PID: 6048 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)
    • msiexec.exe (PID: 2300 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding FDD3F5775BCF411E2F2CE6AD00C803EA C MD5: 9D09DC1EDA745A5F87553048E57620CF)
      • rundll32.exe (PID: 7136 cmdline: rundll32.exe "C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_6790984 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments MD5: 889B99C52A60DD49227C5E485A016679)
    • msiexec.exe (PID: 3808 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding DFEAB60EF0EE39131070D55D2010EA08 MD5: 9D09DC1EDA745A5F87553048E57620CF)
    • msiexec.exe (PID: 1188 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 3D95DD263ED99317D709E6688C830EBF E Global\MSI0000 MD5: 9D09DC1EDA745A5F87553048E57620CF)
  • ScreenConnect.ClientService.exe (PID: 7140 cmdline: "C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-moi41i-relay.screenconnect.com&p=443&s=1d8f6587-f572-4c0d-ac4f-19f114aa9e8c&k=BgIAAACkAABSU0ExAAgAAAEAAQCtUXkVr37HxSNSKxbtVhrTqFy7qJEmo6oCjc91wFOvR4MUBL0kG%2fPw0Y6O4Cbp7p%2bPwDDGLRq%2fNEgwH7S00d6wq1MfdBFm9Uj%2f4fypFZ638LE3OcnK3GXv9nhEoZ1FF8a9u5e0J2AODxPEA5zAmcZC%2b7QZoOfCFaWBpymeq6yYlchLnp1mxk8YwdX7eUAaEm9dE2I95SghGZoVVq0fNyXOlQyIf5EHMgY9Z1LVbVieXeSWVl3znzwAO%2f2y0TpiXGxUUGXL5LRto6Is%2bwKhhKCzwCy3hm8ZX1L10%2fafGHE8wmaJEDg1ddSksTCut%2fYCxPRx7MSQDUTkMhfPMZ4NO3HW" MD5: 75B21D04C69128A7230A0998086B61AA)
    • ScreenConnect.WindowsClient.exe (PID: 7232 cmdline: "C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exe" "RunRole" "fa6d27a7-f258-47e2-8bd0-25ba01636377" "User" MD5: 1778204A8C3BC2B8E5E4194EDBAF7135)
  • svchost.exe (PID: 7372 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
NotaFiscalOnline.ClientSetup.ex#.exeJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security

    Dropped Files

    SourceRuleDescriptionAuthorStrings
    C:\Windows\Temp\~DF726D17E3AFC4398F.TMPJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
      C:\Windows\Temp\~DF3013740FD30A6F2C.TMPJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
        C:\Windows\Temp\~DF1D4001B974C24808.TMPJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
          C:\Windows\Installer\inprogressinstallinfo.ipiJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
            C:\Windows\Temp\~DFFF3D0744094FFDB4.TMPJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
              Click to see the 5 entries

              Memory Dumps

              SourceRuleDescriptionAuthorStrings
              00000000.00000002.1764992488.0000000005B80000.00000004.08000000.00040000.00000000.sdmpJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                00000008.00000000.1788207411.00000000008A2000.00000002.00000001.01000000.00000011.sdmpJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                  00000008.00000002.3577450968.0000000002B11000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                    00000000.00000000.1727146343.0000000000B56000.00000002.00000001.01000000.00000003.sdmpJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                      Process Memory Space: NotaFiscalOnline.ClientSetup.ex#.exe PID: 6652JoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                        Click to see the 3 entries

                        Unpacked PEs

                        SourceRuleDescriptionAuthorStrings
                        0.2.NotaFiscalOnline.ClientSetup.ex#.exe.5b80000.12.raw.unpackJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                          8.2.ScreenConnect.WindowsClient.exe.2b8fa10.3.raw.unpackJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                            8.0.ScreenConnect.WindowsClient.exe.8a0000.0.unpackJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                              0.2.NotaFiscalOnline.ClientSetup.ex#.exe.5b80000.12.unpackJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                                0.0.NotaFiscalOnline.ClientSetup.ex#.exe.c05db0.2.raw.unpackJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                                  Click to see the 3 entries

                                  Sigma Signatures

                                  System Summary

                                  barindex
                                  Sigma detected: CurrentVersion Autorun Keys Modification
                                  Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: ScreenConnect Client (bc180d8c7278c2c2) Credential Provider, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\msiexec.exe, ProcessId: 6048, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{6FF59A85-BC37-4CD4-9733-9712FC2D2A8B}\(Default)
                                  Sigma detected: Windows Processes Suspicious Parent Directory
                                  Source: Process startedAuthor: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7372, ProcessName: svchost.exe

                                  Suricata Signatures

                                  ⊘No Suricata rule has matched

                                  Joe Sandbox Signatures

                                  Click to jump to signature section

                                  Show All Signature Results

                                  AV Detection

                                  barindex
                                  Multi AV Scanner detection for submitted file
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeReversingLabs: Detection: 18%
                                  AI detected suspicious sample
                                  Source: Submited SampleIntegrated Neural Analysis Model: Matched 96.6% probability
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_03790E88 CryptProtectData,7_2_03790E88
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_03791670 CryptProtectData,7_2_03791670
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeEXE: msiexec.exeJump to behavior

                                  Compliance

                                  barindex
                                  EXE planting / hijacking vulnerabilities found
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeEXE: msiexec.exeJump to behavior
                                  Uses 32bit PE files
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                                  Creates install or setup log file
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NotaFiscalOnline.ClientSetup.ex#.exe.logJump to behavior
                                  PE / OLE file has a valid certificate
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: certificate valid
                                  Contains modern PE file flags such as dynamic base (ASLR) or NX
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                  Binary contains paths to debug symbols
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb source: ScreenConnect.WindowsFileManager.exe.2.dr
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientInstallerRunner\obj\Release\ScreenConnect.ClientInstallerRunner.pdb source: NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsInstaller\obj\Release\net20\ScreenConnect.WindowsInstaller.pdbM source: NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsInstaller\obj\Release\net20\ScreenConnect.WindowsInstaller.pdb source: NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdbT source: Microsoft.Deployment.WindowsInstaller.dll.4.dr
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.2.dr
                                  Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller.Package\Microsoft.Deployment.WindowsInstaller.Package.pdb source: Microsoft.Deployment.WindowsInstaller.Package.dll.4.dr
                                  Source: Binary string: C:\Compile\screenconnect\Product\WindowsAuthenticationPackage\bin\Release\ScreenConnect.WindowsAuthenticationPackage.pdb source: ScreenConnect.ClientService.exe, 00000007.00000002.3589887965.00000000020C7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3591088422.0000000012B20000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.2.dr
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: NotaFiscalOnline.ClientSetup.ex#.exe, ScreenConnect.Core.dll.4.dr, ScreenConnect.Core.dll.2.dr
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3576859793.0000000001340000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3577450968.0000000002B11000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3577231347.0000000002AB2000.00000002.00000001.01000000.0000000D.sdmp, ScreenConnect.ClientService.dll.2.dr
                                  Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\DotNetResolver\obj\Debug\DotNetResolver.pdb source: NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 00000007.00000000.1772866438.000000000013D000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.ClientService.exe.2.dr
                                  Source: Binary string: mscorlib.pdb source: ScreenConnect.ClientService.exe, 00000007.00000002.3605920161.0000000004670000.00000004.00000020.00020000.00000000.sdmp
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: NotaFiscalOnline.ClientSetup.ex#.exe, ScreenConnect.Windows.dll.2.dr, ScreenConnect.Windows.dll.4.dr
                                  Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\Compression.Cab\Microsoft.Deployment.Compression.Cab.pdb source: rundll32.exe, 00000004.00000003.1751813739.0000000004D90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1745213701.0000000004F0C000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.Cab.dll.4.dr
                                  Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdb source: Microsoft.Deployment.WindowsInstaller.dll.4.dr
                                  Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: ScreenConnect.ClientService.exe, 00000007.00000002.3575019104.0000000000586000.00000004.00000020.00020000.00000000.sdmp
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\InstallerActions\obj\Release\net20\ScreenConnect.InstallerActions.pdb source: ScreenConnect.InstallerActions.dll.4.dr
                                  Source: Binary string: C:\build\work\eca3d12b\wix3\build\ship\x86\wixca.pdb source: NotaFiscalOnline.ClientSetup.ex#.exe, MSIA6BA.tmp.2.dr, 67a46a.msi.2.dr, MSIA6DA.tmp.2.dr, ScreenConnect.ClientSetup.msi.0.dr, 67a469.rbs.2.dr, MSIAAC3.tmp.2.dr, 67a468.msi.2.dr
                                  Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\Compression\Microsoft.Deployment.Compression.pdb source: rundll32.exe, 00000004.00000003.1745213701.0000000004E9D000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.dll.4.dr
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdbS] source: NotaFiscalOnline.ClientSetup.ex#.exe, ScreenConnect.Windows.dll.2.dr, ScreenConnect.Windows.dll.4.dr
                                  Source: Binary string: screenconnect_windows_credential_provider.pdb source: ScreenConnect.ClientService.exe, 00000007.00000002.3589887965.00000000020C7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3591088422.0000000012B20000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsCredentialProvider.dll.2.dr
                                  Source: Binary string: \??\C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Client.pdb source: ScreenConnect.ClientService.exe, 00000007.00000002.3605920161.0000000004630000.00000004.00000020.00020000.00000000.sdmp
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000008.00000000.1788207411.00000000008A2000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.WindowsClient.exe.2.dr
                                  Source: Binary string: E:\delivery\Dev\wix37_public\build\ship\x86\SfxCA.pdb source: NotaFiscalOnline.ClientSetup.ex#.exe, MSI9E8C.tmp.1.dr, 67a46a.msi.2.dr, ScreenConnect.ClientSetup.msi.0.dr, 67a468.msi.2.dr
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdbi source: ScreenConnect.ClientService.exe, 00000007.00000002.3605920161.0000000004670000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3593829639.000000001B3E2000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Client.dll.2.dr
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdbu source: ScreenConnect.WindowsClient.exe, 00000008.00000000.1788207411.00000000008A2000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.WindowsClient.exe.2.dr
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: ScreenConnect.ClientService.exe, 00000007.00000002.3605920161.0000000004670000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3593829639.000000001B3E2000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Client.dll.2.dr
                                  Source: Binary string: screenconnect_windows_credential_provider.pdb' source: ScreenConnect.ClientService.exe, 00000007.00000002.3589887965.00000000020C7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3591088422.0000000012B20000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsCredentialProvider.dll.2.dr
                                  Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetRunner.pdb source: NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: C:\Windows\System32\msiexec.exeFile opened: z:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: x:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: v:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: t:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: r:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: p:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: n:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: l:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: j:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: h:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: f:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: b:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: y:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: w:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: u:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: s:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: q:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: o:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: m:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: k:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: i:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: g:Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile opened: e:Jump to behavior
                                  Source: C:\Windows\System32\svchost.exeFile opened: c:
                                  Source: C:\Windows\System32\msiexec.exeFile opened: a:Jump to behavior

                                  Networking

                                  barindex
                                  Enables network access during safeboot for specific services
                                  Source: C:\Windows\System32\msiexec.exeRegistry value created: NULL ServiceJump to behavior
                                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                                  Source: global trafficDNS traffic detected: DNS query: instance-moi41i-relay.screenconnect.com
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsAuthenticationPackage.dll.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.WindowsCredentialProvider.dll.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3591088422.0000000012B20000.00000004.00000800.00020000.00000000.sdmp, NotaFiscalOnline.ClientSetup.ex#.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsAuthenticationPackage.dll.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.WindowsCredentialProvider.dll.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsAuthenticationPackage.dll.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.WindowsCredentialProvider.dll.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsAuthenticationPackage.dll.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.WindowsCredentialProvider.dll.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
                                  Source: svchost.exe, 00000009.00000002.3451253006.0000023127E13000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.ver)
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsAuthenticationPackage.dll.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.WindowsCredentialProvider.dll.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsAuthenticationPackage.dll.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.WindowsCredentialProvider.dll.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsAuthenticationPackage.dll.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.WindowsCredentialProvider.dll.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
                                  Source: ScreenConnect.WindowsCredentialProvider.dll.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3591088422.0000000012B20000.00000004.00000800.00020000.00000000.sdmp, NotaFiscalOnline.ClientSetup.ex#.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsAuthenticationPackage.dll.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.WindowsCredentialProvider.dll.2.drString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
                                  Source: svchost.exe, 00000009.00000003.1810757648.0000023128018000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
                                  Source: edb.log.9.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
                                  Source: qmgr.db.9.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
                                  Source: qmgr.db.9.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
                                  Source: svchost.exe, 00000009.00000003.1810757648.0000023128018000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
                                  Source: svchost.exe, 00000009.00000003.1810757648.0000023128018000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
                                  Source: svchost.exe, 00000009.00000003.1810757648.000002312804D000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
                                  Source: qmgr.db.9.drString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
                                  Source: ScreenConnect.ClientService.exe, 00000007.00000002.3605920161.0000000004630000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://instance-moi41i-relay.screenconnect.com:443/
                                  Source: ScreenConnect.ClientService.exe, 00000007.00000002.3605920161.000000000467D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://instance-moi41i-relay.screenconnect.com:443/((instance-moi41i-relay.screenconnect.com
                                  Source: ScreenConnect.ClientService.exe, 00000007.00000002.3605920161.0000000004630000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://instance-moi41i-relay.screenconnect.com:443/A
                                  Source: ScreenConnect.ClientService.exe, 00000007.00000002.3578018147.0000000001367000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.3578018147.0000000001295000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.3578018147.0000000001532000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.3578018147.000000000121B000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.3578018147.0000000001487000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.3578018147.000000000133A000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.3578018147.00000000011EE000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.3578018147.00000000013E5000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.3578018147.000000000155D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://instance-moi41i-relay.screenconnect.com:443/d
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsAuthenticationPackage.dll.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.WindowsCredentialProvider.dll.2.drString found in binary or memory: http://ocsp.digicert.com0
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsAuthenticationPackage.dll.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.WindowsCredentialProvider.dll.2.drString found in binary or memory: http://ocsp.digicert.com0A
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsAuthenticationPackage.dll.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.WindowsCredentialProvider.dll.2.drString found in binary or memory: http://ocsp.digicert.com0C
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsAuthenticationPackage.dll.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.WindowsCredentialProvider.dll.2.drString found in binary or memory: http://ocsp.digicert.com0X
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000002.1738071402.0000000003251000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.3578018147.0000000001122000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                                  Source: rundll32.exe, 00000004.00000003.1745213701.0000000004F0C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1745988359.0000000004D93000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1745213701.0000000004E9D000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.4.dr, Microsoft.Deployment.Compression.dll.4.dr, Microsoft.Deployment.Compression.Cab.dll.4.drString found in binary or memory: http://wixtoolset.org/Whttp://wixtoolset.org/telemetry/v
                                  Source: rundll32.exe, 00000004.00000003.1745213701.0000000004F0C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1745988359.0000000004D93000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1745213701.0000000004E9D000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.4.dr, Microsoft.Deployment.Compression.dll.4.dr, Microsoft.Deployment.Compression.Cab.dll.4.drString found in binary or memory: http://wixtoolset.org/news/
                                  Source: rundll32.exe, 00000004.00000003.1745213701.0000000004F0C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1745988359.0000000004D93000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1745213701.0000000004E9D000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.4.dr, Microsoft.Deployment.Compression.dll.4.dr, Microsoft.Deployment.Compression.Cab.dll.4.drString found in binary or memory: http://wixtoolset.org/releases/
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coml
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, ScreenConnect.WindowsBackstageShell.exe.2.dr, ScreenConnect.ClientService.exe.2.dr, ScreenConnect.WindowsFileManager.exe.2.dr, ScreenConnect.WindowsAuthenticationPackage.dll.2.dr, ScreenConnect.WindowsClient.exe.2.dr, ScreenConnect.WindowsCredentialProvider.dll.2.drString found in binary or memory: http://www.digicert.com/CPS0
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fonts.com
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.goodfont.co.kr
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.com
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.com
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sandoll.co.kr
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.com
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.typography.netD
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                                  Source: ScreenConnect.WindowsCredentialProvider.dll.2.drString found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
                                  Source: ScreenConnect.Core.dll.2.drString found in binary or memory: https://feedback.screenconnect.com/Feedback.axd
                                  Source: svchost.exe, 00000009.00000003.1810757648.00000231280C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.drString found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
                                  Source: edb.log.9.dr, qmgr.db.9.drString found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
                                  Source: edb.log.9.dr, qmgr.db.9.drString found in binary or memory: https://g.live.com/odclientsettings/ProdV2
                                  Source: edb.log.9.dr, qmgr.db.9.drString found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
                                  Source: svchost.exe, 00000009.00000003.1810757648.00000231280C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.drString found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
                                  Source: svchost.exe, 00000009.00000003.1810757648.00000231280C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.drString found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
                                  Source: edb.log.9.drString found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
                                  Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
                                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
                                  Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
                                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
                                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49795
                                  Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
                                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50000
                                  Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
                                  Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
                                  Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
                                  Source: unknownNetwork traffic detected: HTTP traffic on port 49795 -> 443
                                  Source: unknownNetwork traffic detected: HTTP traffic on port 50000 -> 443
                                  Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
                                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
                                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49869
                                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
                                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
                                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
                                  Source: unknownNetwork traffic detected: HTTP traffic on port 49869 -> 443
                                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734

                                  Spam, unwanted Advertisements and Ransom Demands

                                  barindex
                                  Reads the Security eventlog
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\ScreenConnectJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\ScreenConnectJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\ScreenConnectJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                                  Reads the System eventlog
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\ScreenConnectJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior

                                  System Summary

                                  barindex
                                  Detected potential unwanted application
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exePE Siganture Subject Chain: CN="Connectwise, LLC", O="Connectwise, LLC", L=Tampa, S=Florida, C=US
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_050B28C0 CreateProcessAsUserW,7_2_050B28C0
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\67a468.msiJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\inprogressinstallinfo.ipiJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\SourceHash{8ED2474F-3FEA-BB0F-7BE5-1BCA7E4AB8D2}Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSIA6BA.tmpJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSIA6DA.tmpJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSIAAC3.tmpJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\67a46a.msiJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\67a46a.msiJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\{8ED2474F-3FEA-BB0F-7BE5-1BCA7E4AB8D2}Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\{8ED2474F-3FEA-BB0F-7BE5-1BCA7E4AB8D2}\DefaultIconJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeFile created: C:\Windows\Installer\wix{8ED2474F-3FEA-BB0F-7BE5-1BCA7E4AB8D2}.SchedServiceConfig.rmiJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)Jump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\x3aodwuh.tmpJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\x3aodwuh.newcfgJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\4n225xi3.tmpJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\4n225xi3.newcfgJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\snm44ufm.tmpJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\snm44ufm.newcfgJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\qvsa1fyj.tmpJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\qvsa1fyj.newcfgJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\n3gwxb5y.tmpJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\n3gwxb5y.newcfgJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\zgsk4twd.tmpJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\zgsk4twd.newcfgJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\z5ox3kh0.tmpJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\z5ox3kh0.newcfgJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\xopi4msf.tmpJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\xopi4msf.newcfgJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\3gd2ltu3.tmpJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\3gd2ltu3.newcfgJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\zkzbnecy.tmpJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\zkzbnecy.newcfgJump to behavior
                                  Source: C:\Windows\System32\svchost.exeFile created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
                                  Source: C:\Windows\System32\msiexec.exeFile deleted: C:\Windows\Installer\MSIA6DA.tmpJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeCode function: 0_2_05B487B80_2_05B487B8
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeCode function: 0_2_05B4BA300_2_05B4BA30
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeCode function: 0_2_05B487A80_2_05B487A8
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeCode function: 0_2_05B60CB80_2_05B60CB8
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeCode function: 0_2_05B61E9B0_2_05B61E9B
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_0372B3D07_2_0372B3D0
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_0372DEB17_2_0372DEB1
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_039D0B547_2_039D0B54
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_03A82F647_2_03A82F64
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_03A8C2947_2_03A8C294
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_039D82147_2_039D8214
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_039D8A547_2_039D8A54
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_039DA6447_2_039DA644
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_039CA6747_2_039CA674
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_03A819847_2_03A81984
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_03A841847_2_03A84184
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_039DA1C47_2_039DA1C4
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_03ABA5577_2_03ABA557
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_03A971547_2_03A97154
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_03A968E47_2_03A968E4
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_03A82CF47_2_03A82CF4
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_039CC4F47_2_039CC4F4
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_039DB8447_2_039DB844
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_03A964747_2_03A96474
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_039CC0747_2_039CC074
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_008CD6F87_2_008CD6F8
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_050B00407_2_050B0040
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_050B00407_2_050B0040
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_03A844447_2_03A84444
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FFD9B3D70088_2_00007FFD9B3D7008
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FFD9B3D10D78_2_00007FFD9B3D10D7
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FFD9B3D10CF8_2_00007FFD9B3D10CF
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FFD9B6E000A8_2_00007FFD9B6E000A
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FFD9B6E76FA8_2_00007FFD9B6E76FA
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FFD9B6EB6C18_2_00007FFD9B6EB6C1
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FFD9B6F0EFA8_2_00007FFD9B6F0EFA
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FFD9B6E6DE28_2_00007FFD9B6E6DE2
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FFD9B6F10D38_2_00007FFD9B6F10D3
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FFD9B6E951B8_2_00007FFD9B6E951B
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000002.1751106297.0000000004413000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameScreenConnect.Windows.dll< vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000002.1762000119.0000000005910000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenamelibwebp.dllB vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000002.1762000119.0000000005910000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenamezlib.dll2 vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000002.1762000119.0000000005910000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameScreenConnect.Windows.dll< vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000000.1727146343.0000000000B56000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameScreenConnect.Core.dll< vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000000.1727146343.0000000000B56000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamelibwebp.dllB vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000000.1727146343.0000000000B56000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamezlib.dll2 vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000000.1727146343.0000000000B56000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameScreenConnect.Windows.dll< vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000000.1727146343.0000000000B56000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameScreenConnect.WindowsInstaller.dll< vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000000.1727146343.000000000107F000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameScreenConnect.ClientInstallerRunner.exe< vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000000.1727146343.000000000107F000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameDotNetResolver.exe4 vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000002.1782974983.0000000008087000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemsiexec.exe.muiX vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000002.1782974983.0000000008087000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemsiexec.exeX vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000002.1761098891.0000000005830000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameScreenConnect.WindowsInstaller.dll< vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000002.1764992488.0000000005D3C000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameScreenConnect.InstallerActions.dll< vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000002.1764992488.0000000005D3C000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameSfxCA.dllL vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000002.1764992488.0000000005D3C000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenamewixca.dll\ vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000002.1764992488.0000000005D3C000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameScreenConnect.ClientInstallerRunner.exe< vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000002.1738071402.0000000003B39000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameScreenConnect.InstallerActions.dll< vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000002.1738071402.0000000003B39000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSfxCA.dllL vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000002.1738071402.0000000003B39000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewixca.dll\ vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000002.1737934776.00000000018E0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameDotNetResolver.exe4 vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000002.1761559461.0000000005880000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameScreenConnect.Core.dll< vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeBinary or memory string: OriginalFilenameScreenConnect.Core.dll< vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeBinary or memory string: OriginalFilenamelibwebp.dllB vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeBinary or memory string: OriginalFilenamezlib.dll2 vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeBinary or memory string: OriginalFilenameScreenConnect.Windows.dll< vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeBinary or memory string: OriginalFilenameScreenConnect.WindowsInstaller.dll< vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeBinary or memory string: OriginalFilenameScreenConnect.InstallerActions.dll< vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeBinary or memory string: OriginalFilenameSfxCA.dllL vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeBinary or memory string: OriginalFilenamewixca.dll\ vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeBinary or memory string: OriginalFilenameScreenConnect.ClientInstallerRunner.exe< vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeBinary or memory string: OriginalFilenameDotNetResolver.exe4 vs NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                                  Source: 0.0.NotaFiscalOnline.ClientSetup.ex#.exe.bdc3d4.5.raw.unpack, WindowsToolkit.csCryptographic APIs: 'CreateDecryptor'
                                  Source: 0.2.NotaFiscalOnline.ClientSetup.ex#.exe.5910000.7.raw.unpack, WindowsToolkit.csCryptographic APIs: 'CreateDecryptor'
                                  Source: 0.2.NotaFiscalOnline.ClientSetup.ex#.exe.5880000.6.raw.unpack, CursorBuffer.csCryptographic APIs: 'TransformBlock'
                                  Source: 0.0.NotaFiscalOnline.ClientSetup.ex#.exe.b563d4.1.raw.unpack, CursorBuffer.csCryptographic APIs: 'TransformBlock'
                                  Source: 0.0.NotaFiscalOnline.ClientSetup.ex#.exe.bdc3d4.5.raw.unpack, WindowsExtensions.csSecurity API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
                                  Source: 0.0.NotaFiscalOnline.ClientSetup.ex#.exe.bdc3d4.5.raw.unpack, WindowsExtensions.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                                  Source: 0.0.NotaFiscalOnline.ClientSetup.ex#.exe.bdc3d4.5.raw.unpack, WindowsExtensions.csSecurity API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
                                  Source: 0.2.NotaFiscalOnline.ClientSetup.ex#.exe.5910000.7.raw.unpack, WindowsExtensions.csSecurity API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
                                  Source: 0.2.NotaFiscalOnline.ClientSetup.ex#.exe.5910000.7.raw.unpack, WindowsExtensions.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                                  Source: 0.2.NotaFiscalOnline.ClientSetup.ex#.exe.5910000.7.raw.unpack, WindowsExtensions.csSecurity API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
                                  Source: classification engineClassification label: mal66.evad.winEXE@16/66@4/2
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)Jump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NotaFiscalOnline.ClientSetup.ex#.exe.logJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeMutant created: NULL
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeMutant created: \BaseNamedObjects\Global\netfxeventlog.1.0
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeFile created: C:\Users\user\AppData\Local\Temp\ScreenConnectJump to behavior
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_6790984 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeReversingLabs: Detection: 18%
                                  Source: ScreenConnect.ClientService.exeString found in binary or memory: $F294ACFC-3146-4483-A7BF-ADDCA7C260E2
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeString found in binary or memory: $F294ACFC-3146-4483-A7BF-ADDCA7C260E2
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeString found in binary or memory: $F294ACFC-3146-4483-A7BF-ADDCA7C260E2)
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeFile read: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeJump to behavior
                                  Source: unknownProcess created: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exe "C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exe"
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ScreenConnect\24.3.7.9067\bc180d8c7278c2c2\ScreenConnect.ClientSetup.msi"
                                  Source: unknownProcess created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
                                  Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding FDD3F5775BCF411E2F2CE6AD00C803EA C
                                  Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_6790984 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                                  Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding DFEAB60EF0EE39131070D55D2010EA08
                                  Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 3D95DD263ED99317D709E6688C830EBF E Global\MSI0000
                                  Source: unknownProcess created: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe "C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-moi41i-relay.screenconnect.com&p=443&s=1d8f6587-f572-4c0d-ac4f-19f114aa9e8c&k=BgIAAACkAABSU0ExAAgAAAEAAQCtUXkVr37HxSNSKxbtVhrTqFy7qJEmo6oCjc91wFOvR4MUBL0kG%2fPw0Y6O4Cbp7p%2bPwDDGLRq%2fNEgwH7S00d6wq1MfdBFm9Uj%2f4fypFZ638LE3OcnK3GXv9nhEoZ1FF8a9u5e0J2AODxPEA5zAmcZC%2b7QZoOfCFaWBpymeq6yYlchLnp1mxk8YwdX7eUAaEm9dE2I95SghGZoVVq0fNyXOlQyIf5EHMgY9Z1LVbVieXeSWVl3znzwAO%2f2y0TpiXGxUUGXL5LRto6Is%2bwKhhKCzwCy3hm8ZX1L10%2fafGHE8wmaJEDg1ddSksTCut%2fYCxPRx7MSQDUTkMhfPMZ4NO3HW"
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess created: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exe "C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exe" "RunRole" "fa6d27a7-f258-47e2-8bd0-25ba01636377" "User"
                                  Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ScreenConnect\24.3.7.9067\bc180d8c7278c2c2\ScreenConnect.ClientSetup.msi"Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding FDD3F5775BCF411E2F2CE6AD00C803EA CJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding DFEAB60EF0EE39131070D55D2010EA08Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 3D95DD263ED99317D709E6688C830EBF E Global\MSI0000Jump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_6790984 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArgumentsJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess created: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exe "C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exe" "RunRole" "fa6d27a7-f258-47e2-8bd0-25ba01636377" "User"Jump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: apphelp.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: mscoree.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: kernel.appcore.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: wldp.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: amsi.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: userenv.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: profapi.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: version.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: msasn1.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: gpapi.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: cryptsp.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: rsaenh.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: cryptbase.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: uxtheme.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: windows.storage.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: propsys.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: edputil.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: urlmon.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: iertutil.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: srvcli.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: netutils.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: sspicli.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: wintypes.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: appresolver.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: bcp47langs.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: slc.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: sppc.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: apphelp.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: aclayers.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mpr.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msi.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: srpapi.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: tsappcmp.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: uxtheme.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: textinputframework.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: coreuicomponents.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: coremessaging.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: ntmarta.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wintypes.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wintypes.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wintypes.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: windows.storage.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wldp.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: propsys.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: textshaping.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: netapi32.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wkscli.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: netutils.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: version.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mscoree.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: profapi.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sspicli.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msihnd.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: pcacli.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: apphelp.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: aclayers.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: sfc.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: msi.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: tsappcmp.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: userenv.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: profapi.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: sspicli.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: netapi32.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: wkscli.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: netutils.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: srclient.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: spp.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: powrprof.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: vssapi.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: vsstrace.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: umpdc.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: wldp.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: mscoree.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: version.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: rstrtmgr.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: ncrypt.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: ntasn1.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: windows.storage.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: pcacli.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: mpr.dllJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeSection loaded: cabinet.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: apphelp.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: aclayers.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mpr.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msi.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: cabinet.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: apphelp.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: aclayers.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mpr.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msi.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: version.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: apphelp.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: aclayers.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mpr.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msi.dllJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: version.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: apphelp.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: mscoree.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: kernel.appcore.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: cryptsp.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: rsaenh.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: cryptbase.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: urlmon.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: iertutil.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: srvcli.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: netutils.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: sspicli.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: windows.storage.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: wldp.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: propsys.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: version.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: profapi.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: dpapi.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: amsi.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: userenv.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: msasn1.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: gpapi.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: wtsapi32.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: winsta.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: mswsock.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: dnsapi.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: iphlpapi.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: rasadhlp.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: netapi32.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: samcli.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: samlib.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: fwpuclnt.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: dhcpcsvc6.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: dhcpcsvc.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: winnsi.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: rasapi32.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: rasman.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: rtutils.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: winhttp.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: ntmarta.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: mscoree.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: apphelp.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: kernel.appcore.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: version.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: uxtheme.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: cryptsp.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: rsaenh.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: cryptbase.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: windows.storage.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: wldp.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: profapi.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: amsi.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: userenv.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: urlmon.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: iertutil.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: srvcli.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: netutils.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: sspicli.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: propsys.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: windowscodecs.dllJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeSection loaded: dwrite.dllJump to behavior
                                  Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: qmgr.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: bitsperf.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: firewallapi.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: esent.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: dnsapi.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: iphlpapi.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: fwbase.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: flightsettings.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: netprofm.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: bitsigd.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: upnp.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: ssdpapi.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: urlmon.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: iertutil.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: srvcli.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: appxdeploymentclient.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: wsmauto.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: miutils.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: wsmsvc.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: dsrole.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: pcwum.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: mi.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: gpapi.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: wkscli.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: msv1_0.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: ntlmshared.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: cryptdll.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: webio.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: mswsock.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: winnsi.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: rasadhlp.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: fwpuclnt.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: rmclient.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: usermgrcli.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: execmodelclient.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: propsys.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: coremessaging.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: twinapi.appcore.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: onecorecommonproxystub.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: execmodelproxy.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: resourcepolicyclient.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: vssapi.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: vsstrace.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: samcli.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: samlib.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: es.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: bitsproxy.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc6.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: schannel.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: mskeyprotect.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: ntasn1.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: ncrypt.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: ncryptsslp.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: msasn1.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: rsaenh.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: dpapi.dll
                                  Source: C:\Windows\System32\svchost.exeSection loaded: mpr.dll
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
                                  Source: Window RecorderWindow detected: More than 3 window changes detected
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: certificate valid
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic file information: File size 5620152 > 1048576
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x533200
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb source: ScreenConnect.WindowsFileManager.exe.2.dr
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientInstallerRunner\obj\Release\ScreenConnect.ClientInstallerRunner.pdb source: NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsInstaller\obj\Release\net20\ScreenConnect.WindowsInstaller.pdbM source: NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsInstaller\obj\Release\net20\ScreenConnect.WindowsInstaller.pdb source: NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdbT source: Microsoft.Deployment.WindowsInstaller.dll.4.dr
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.2.dr
                                  Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller.Package\Microsoft.Deployment.WindowsInstaller.Package.pdb source: Microsoft.Deployment.WindowsInstaller.Package.dll.4.dr
                                  Source: Binary string: C:\Compile\screenconnect\Product\WindowsAuthenticationPackage\bin\Release\ScreenConnect.WindowsAuthenticationPackage.pdb source: ScreenConnect.ClientService.exe, 00000007.00000002.3589887965.00000000020C7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3591088422.0000000012B20000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.2.dr
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: NotaFiscalOnline.ClientSetup.ex#.exe, ScreenConnect.Core.dll.4.dr, ScreenConnect.Core.dll.2.dr
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3576859793.0000000001340000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3577450968.0000000002B11000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3577231347.0000000002AB2000.00000002.00000001.01000000.0000000D.sdmp, ScreenConnect.ClientService.dll.2.dr
                                  Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\DotNetResolver\obj\Debug\DotNetResolver.pdb source: NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 00000007.00000000.1772866438.000000000013D000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.ClientService.exe.2.dr
                                  Source: Binary string: mscorlib.pdb source: ScreenConnect.ClientService.exe, 00000007.00000002.3605920161.0000000004670000.00000004.00000020.00020000.00000000.sdmp
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: NotaFiscalOnline.ClientSetup.ex#.exe, ScreenConnect.Windows.dll.2.dr, ScreenConnect.Windows.dll.4.dr
                                  Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\Compression.Cab\Microsoft.Deployment.Compression.Cab.pdb source: rundll32.exe, 00000004.00000003.1751813739.0000000004D90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1745213701.0000000004F0C000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.Cab.dll.4.dr
                                  Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdb source: Microsoft.Deployment.WindowsInstaller.dll.4.dr
                                  Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: ScreenConnect.ClientService.exe, 00000007.00000002.3575019104.0000000000586000.00000004.00000020.00020000.00000000.sdmp
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\InstallerActions\obj\Release\net20\ScreenConnect.InstallerActions.pdb source: ScreenConnect.InstallerActions.dll.4.dr
                                  Source: Binary string: C:\build\work\eca3d12b\wix3\build\ship\x86\wixca.pdb source: NotaFiscalOnline.ClientSetup.ex#.exe, MSIA6BA.tmp.2.dr, 67a46a.msi.2.dr, MSIA6DA.tmp.2.dr, ScreenConnect.ClientSetup.msi.0.dr, 67a469.rbs.2.dr, MSIAAC3.tmp.2.dr, 67a468.msi.2.dr
                                  Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\Compression\Microsoft.Deployment.Compression.pdb source: rundll32.exe, 00000004.00000003.1745213701.0000000004E9D000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.dll.4.dr
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdbS] source: NotaFiscalOnline.ClientSetup.ex#.exe, ScreenConnect.Windows.dll.2.dr, ScreenConnect.Windows.dll.4.dr
                                  Source: Binary string: screenconnect_windows_credential_provider.pdb source: ScreenConnect.ClientService.exe, 00000007.00000002.3589887965.00000000020C7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3591088422.0000000012B20000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsCredentialProvider.dll.2.dr
                                  Source: Binary string: \??\C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Client.pdb source: ScreenConnect.ClientService.exe, 00000007.00000002.3605920161.0000000004630000.00000004.00000020.00020000.00000000.sdmp
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000008.00000000.1788207411.00000000008A2000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.WindowsClient.exe.2.dr
                                  Source: Binary string: E:\delivery\Dev\wix37_public\build\ship\x86\SfxCA.pdb source: NotaFiscalOnline.ClientSetup.ex#.exe, MSI9E8C.tmp.1.dr, 67a46a.msi.2.dr, ScreenConnect.ClientSetup.msi.0.dr, 67a468.msi.2.dr
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdbi source: ScreenConnect.ClientService.exe, 00000007.00000002.3605920161.0000000004670000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3593829639.000000001B3E2000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Client.dll.2.dr
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdbu source: ScreenConnect.WindowsClient.exe, 00000008.00000000.1788207411.00000000008A2000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.WindowsClient.exe.2.dr
                                  Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: ScreenConnect.ClientService.exe, 00000007.00000002.3605920161.0000000004670000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3593829639.000000001B3E2000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Client.dll.2.dr
                                  Source: Binary string: screenconnect_windows_credential_provider.pdb' source: ScreenConnect.ClientService.exe, 00000007.00000002.3589887965.00000000020C7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000008.00000002.3591088422.0000000012B20000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsCredentialProvider.dll.2.dr
                                  Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetRunner.pdb source: NotaFiscalOnline.ClientSetup.ex#.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

                                  Data Obfuscation

                                  barindex
                                  .NET source code contains potential unpacker
                                  Source: 0.2.NotaFiscalOnline.ClientSetup.ex#.exe.18e0000.0.raw.unpack, Program.cs.Net Code: Main System.Reflection.Assembly.Load(byte[])
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeStatic PE information: real checksum: 0x54d1c1 should be: 0x5623c4
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeCode function: 0_2_017B70B0 push eax; mov dword ptr [esp], ecx0_2_017B70C1
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeCode function: 0_2_05B46460 pushfd ; retf 0_2_05B46461
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeCode function: 0_2_05B46462 push 8405B1CBh; retf 0_2_05B46469
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeCode function: 0_2_05B43AD7 push ebx; retf 0_2_05B43ADA
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeCode function: 0_2_05B64958 push eax; mov dword ptr [esp], edx0_2_05B649F4
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeCode function: 0_2_05B63A99 push ebx; retf 0_2_05B63ADA
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_0372C5F3 push ss; retf 0080h7_2_0372C5F4
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_0372C3E3 push ss; retf 0080h7_2_0372C3E4
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_0372C1CF push ss; retf 0080h7_2_0372C2DC
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_0372C592 push ss; retf 0080h7_2_0372C594
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_0372C45B push ss; retf 0080h7_2_0372C45C
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_0372C21A push ss; retf 0080h7_2_0372C2DC
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_03728CFA push es; ret 7_2_03728CFC
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_0372C4CB push ss; retf 0080h7_2_0372C4CC
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_037300A2 push 0000000Bh; ret 7_2_037300FC
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_03AB0FFA push ecx; ret 7_2_03AB100D
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_008C6490 push 00000003h; ret 7_2_008C64A0
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_008C7732 push eax; iretd 7_2_008C7739
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_008C59C1 push 00000003h; ret 7_2_008C59D0
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_03793A9B push ebx; retf 7_2_03793ADA
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_050B8750 push eax; iretd 7_2_050B8759
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FFD9B3E09D8 push ebx; retf 8_2_00007FFD9B3E098A
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FFD9B3E08CD push ebx; retf 8_2_00007FFD9B3E098A
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FFD9B6E92CC push 0000006Ch; iretd 8_2_00007FFD9B6E93B4
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FFD9B6E2F5A pushfd ; iretd 8_2_00007FFD9B6E2F5B
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FFD9B6E9355 push 0000006Ch; iretd 8_2_00007FFD9B6E93B4
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FFD9B6E8EF8 pushad ; retn 5F05h8_2_00007FFD9B6E919D
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FFD9B6EC1A6 push ds; iretd 8_2_00007FFD9B6EC22F
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FFD9B6E752B push ebx; iretd 8_2_00007FFD9B6E756A

                                  Persistence and Installation Behavior

                                  barindex
                                  Possible COM Object hijacking
                                  Source: c:\program files (x86)\screenconnect client (bc180d8c7278c2c2)\screenconnect.windowscredentialprovider.dllCOM Object registered for dropped file: hkey_local_machine\software\classes\clsid\{6ff59a85-bc37-4cd4-9733-9712fc2d2a8b}\inprocserver32
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSIA6DA.tmpJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeJump to dropped file
                                  Source: C:\Windows\SysWOW64\msiexec.exeFile created: C:\Users\user\AppData\Local\Temp\MSI9E8C.tmpJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Client.dllJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsAuthenticationPackage.dllJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsFileManager.exeJump to dropped file
                                  Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dllJump to dropped file
                                  Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp-\Microsoft.Deployment.Compression.dllJump to dropped file
                                  Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp-\ScreenConnect.Core.dllJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsBackstageShell.exeJump to dropped file
                                  Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp-\Microsoft.Deployment.Compression.Cab.dllJump to dropped file
                                  Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp-\ScreenConnect.InstallerActions.dllJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Windows.dllJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.dllJump to dropped file
                                  Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp-\ScreenConnect.Windows.dllJump to dropped file
                                  Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp-\Microsoft.Deployment.WindowsInstaller.dllJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsCredentialProvider.dllJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSIAAC3.tmpJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Core.dllJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSIA6DA.tmpJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSIAAC3.tmpJump to dropped file
                                  Source: ScreenConnect.ClientService.dll.2.drBinary or memory string: bcdedit.exeg/copy {current} /d "Reboot and Reconnect Safe Mode"7{.{8}-.{4}-.{4}-.{4}-.{12}}
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NotaFiscalOnline.ClientSetup.ex#.exe.logJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeRegistry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\ApplicationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeRegistry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (bc180d8c7278c2c2)Jump to behavior

                                  Hooking and other Techniques for Hiding and Protection

                                  barindex
                                  Contains functionality to hide user accounts
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000002.1762000119.0000000005910000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000000.1727146343.0000000000B56000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                                  Source: rundll32.exe, 00000004.00000003.1745213701.0000000004F18000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                                  Source: ScreenConnect.ClientService.exe, 00000007.00000002.3598309637.0000000003922000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3576859793.0000000001340000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3577450968.0000000002B11000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000002.3577231347.0000000002AB2000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
                                  Source: NotaFiscalOnline.ClientSetup.ex#.exeString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                                  Source: ScreenConnect.ClientService.dll.2.drString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
                                  Source: ScreenConnect.Windows.dll.2.drString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                                  Source: ScreenConnect.Windows.dll.4.drString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeMemory allocated: 17B0000 memory reserve | memory write watchJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeMemory allocated: 3250000 memory reserve | memory write watchJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeMemory allocated: 1810000 memory reserve | memory write watchJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeMemory allocated: 69D0000 memory reserve | memory write watchJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeMemory allocated: 6100000 memory reserve | memory write watchJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeMemory allocated: 8C0000 memory reserve | memory write watchJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeMemory allocated: 10C0000 memory reserve | memory write watchJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeMemory allocated: 30C0000 memory reserve | memory write watchJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeMemory allocated: E60000 memory reserve | memory write watchJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeMemory allocated: 1AB10000 memory reserve | memory write watchJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_0372AFD2 sgdt fword ptr [eax]7_2_0372AFD2
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_03923684 sldt word ptr [eax]7_2_03923684
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeThread delayed: delay time: 922337203685477Jump to behavior
                                  Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Installer\MSIA6DA.tmpJump to dropped file
                                  Source: C:\Windows\SysWOW64\msiexec.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI9E8C.tmpJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Client.dllJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsAuthenticationPackage.dllJump to dropped file
                                  Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dllJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsFileManager.exeJump to dropped file
                                  Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp-\Microsoft.Deployment.Compression.dllJump to dropped file
                                  Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp-\ScreenConnect.Core.dllJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsBackstageShell.exeJump to dropped file
                                  Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp-\Microsoft.Deployment.Compression.Cab.dllJump to dropped file
                                  Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp-\ScreenConnect.InstallerActions.dllJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Windows.dllJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.dllJump to dropped file
                                  Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp-\ScreenConnect.Windows.dllJump to dropped file
                                  Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp-\Microsoft.Deployment.WindowsInstaller.dllJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsCredentialProvider.dllJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Installer\MSIAAC3.tmpJump to dropped file
                                  Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Core.dllJump to dropped file
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeAPI coverage: 2.1 %
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exe TID: 6756Thread sleep time: -922337203685477s >= -30000sJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe TID: 7208Thread sleep count: 38 > 30Jump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe TID: 7436Thread sleep time: -30000s >= -30000sJump to behavior
                                  Source: C:\Windows\System32\svchost.exe TID: 7396Thread sleep time: -30000s >= -30000s
                                  Source: C:\Windows\System32\svchost.exe TID: 7396Thread sleep time: -30000s >= -30000s
                                  Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0
                                  Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeThread delayed: delay time: 922337203685477Jump to behavior
                                  Source: ScreenConnect.ClientService.exe, 00000007.00000002.3605920161.0000000004630000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllQ
                                  Source: svchost.exe, 00000009.00000002.3451371746.0000023127E5D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                                  Source: svchost.exe, 00000009.00000002.3450840821.000002312282B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW`
                                  Source: C:\Windows\System32\msiexec.exeProcess information queried: ProcessInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_03AB3FF7 mov eax, dword ptr fs:[00000030h]7_2_03AB3FF7
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess token adjusted: DebugJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeProcess token adjusted: DebugJump to behavior
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeMemory allocated: page read and write | page guardJump to behavior

                                  HIPS / PFW / Operating System Protection Evasion

                                  barindex
                                  .NET source code references suspicious native API functions
                                  Source: 0.2.NotaFiscalOnline.ClientSetup.ex#.exe.18e0000.0.raw.unpack, Program.csReference to suspicious API methods: FindResource(moduleHandle, e.Name, "FILES")
                                  Source: 0.0.NotaFiscalOnline.ClientSetup.ex#.exe.bdc3d4.5.raw.unpack, WindowsMemoryNativeLibrary.csReference to suspicious API methods: WindowsNative.VirtualAlloc(attemptImageBase, dwSize, WindowsNative.MEM.MEM_COMMIT | WindowsNative.MEM.MEM_RESERVE, WindowsNative.PAGE.PAGE_READWRITE)
                                  Source: 0.0.NotaFiscalOnline.ClientSetup.ex#.exe.bdc3d4.5.raw.unpack, WindowsMemoryNativeLibrary.csReference to suspicious API methods: WindowsNative.LoadLibrary(loadedImageBase + ptr[i].Name)
                                  Source: 0.0.NotaFiscalOnline.ClientSetup.ex#.exe.bdc3d4.5.raw.unpack, WindowsMemoryNativeLibrary.csReference to suspicious API methods: WindowsNative.GetProcAddress(intPtr, ptr5)
                                  Source: 0.0.NotaFiscalOnline.ClientSetup.ex#.exe.bdc3d4.5.raw.unpack, WindowsMemoryNativeLibrary.csReference to suspicious API methods: WindowsNative.VirtualProtect(loadedImageBase + sectionHeaders[i].VirtualAddress, (IntPtr)num, flNewProtect, &pAGE)
                                  Source: 0.0.NotaFiscalOnline.ClientSetup.ex#.exe.bdc3d4.5.raw.unpack, WindowsExtensions.csReference to suspicious API methods: HandleMinder.CreateWithFunc(WindowsNative.OpenProcess(processAccess, bInheritHandle: false, processID), WindowsNative.CloseHandle)
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeProcess created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ScreenConnect\24.3.7.9067\bc180d8c7278c2c2\ScreenConnect.ClientSetup.msi"Jump to behavior
                                  Source: unknownProcess created: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe "c:\program files (x86)\screenconnect client (bc180d8c7278c2c2)\screenconnect.clientservice.exe" "?e=access&y=guest&h=instance-moi41i-relay.screenconnect.com&p=443&s=1d8f6587-f572-4c0d-ac4f-19f114aa9e8c&k=bgiaaackaabsu0exaagaaaeaaqctuxkvr37hxsnskxbtvhrtqfy7qjemo6ocjc91wfovr4mubl0kg%2fpw0y6o4cbp7p%2bpwddglrq%2fnegwh7s00d6wq1mfdbfm9uj%2f4fypfz638le3ocnk3gxv9nheoz1ff8a9u5e0j2aodxpea5zamczc%2b7qzoofcfawbpymeq6yylchlnp1mxk8ywdx7euaaem9de2i95sghgzovvq0fnyxolqyif5ehmgy9z1lvbviexeswvl3znzwao%2f2y0tpixgxuugxl5lrto6is%2bwkhhkczwcy3hm8zx1l10%2fafghe8wmajedg1ddskstcut%2fycxprx7msqdutkmhfpmz4no3hw"
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000000.1788207411.00000000008A2000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.WindowsClient.exe.2.drBinary or memory string: Progman
                                  Source: ScreenConnect.WindowsClient.exe, 00000008.00000000.1788207411.00000000008A2000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.WindowsClient.exe.2.drBinary or memory string: Shell_TrayWnd-Shell_SecondaryTrayWnd%MsgrIMEWindowClass
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeCode function: 7_2_03AB1010 cpuid 7_2_03AB1010
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                                  Source: C:\Windows\SysWOW64\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
                                  Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp-\Microsoft.Deployment.WindowsInstaller.dll VolumeInformationJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp-\ScreenConnect.InstallerActions.dll VolumeInformationJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp-\ScreenConnect.Core.dll VolumeInformationJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp-\ScreenConnect.Windows.dll VolumeInformationJump to behavior
                                  Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.dll VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.dll VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Core.dll VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Windows.dll VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Client.dll VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exe VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Client.dll VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Core.dll VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Windows.dll VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.dll VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformationJump to behavior
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformationJump to behavior
                                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
                                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
                                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
                                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
                                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
                                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
                                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                                  Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exeCode function: 8_2_00007FFD9B3D3642 CreateNamedPipeW,8_2_00007FFD9B3D3642
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeCode function: 0_2_05B42D07 RtlGetVersion,0_2_05B42D07
                                  Source: C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                                  Lowering of HIPS / PFW / Operating System Security Settings

                                  barindex
                                  Modifies security policies related information
                                  Source: C:\Windows\System32\msiexec.exeRegistry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa Authentication PackagesJump to behavior
                                  Source: Yara matchFile source: NotaFiscalOnline.ClientSetup.ex#.exe, type: SAMPLE
                                  Source: Yara matchFile source: 0.2.NotaFiscalOnline.ClientSetup.ex#.exe.5b80000.12.raw.unpack, type: UNPACKEDPE
                                  Source: Yara matchFile source: 8.2.ScreenConnect.WindowsClient.exe.2b8fa10.3.raw.unpack, type: UNPACKEDPE
                                  Source: Yara matchFile source: 8.0.ScreenConnect.WindowsClient.exe.8a0000.0.unpack, type: UNPACKEDPE
                                  Source: Yara matchFile source: 0.2.NotaFiscalOnline.ClientSetup.ex#.exe.5b80000.12.unpack, type: UNPACKEDPE
                                  Source: Yara matchFile source: 0.0.NotaFiscalOnline.ClientSetup.ex#.exe.c05db0.2.raw.unpack, type: UNPACKEDPE
                                  Source: Yara matchFile source: 0.0.NotaFiscalOnline.ClientSetup.ex#.exe.bdc3d4.5.raw.unpack, type: UNPACKEDPE
                                  Source: Yara matchFile source: 0.0.NotaFiscalOnline.ClientSetup.ex#.exe.b563d4.1.raw.unpack, type: UNPACKEDPE
                                  Source: Yara matchFile source: 0.0.NotaFiscalOnline.ClientSetup.ex#.exe.b40000.0.unpack, type: UNPACKEDPE
                                  Source: Yara matchFile source: 00000000.00000002.1764992488.0000000005B80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                                  Source: Yara matchFile source: 00000008.00000000.1788207411.00000000008A2000.00000002.00000001.01000000.00000011.sdmp, type: MEMORY
                                  Source: Yara matchFile source: 00000008.00000002.3577450968.0000000002B11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                                  Source: Yara matchFile source: 00000000.00000000.1727146343.0000000000B56000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                                  Source: Yara matchFile source: Process Memory Space: NotaFiscalOnline.ClientSetup.ex#.exe PID: 6652, type: MEMORYSTR
                                  Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 7136, type: MEMORYSTR
                                  Source: Yara matchFile source: Process Memory Space: ScreenConnect.ClientService.exe PID: 7140, type: MEMORYSTR
                                  Source: Yara matchFile source: Process Memory Space: ScreenConnect.WindowsClient.exe PID: 7232, type: MEMORYSTR
                                  Source: Yara matchFile source: C:\Windows\Temp\~DF726D17E3AFC4398F.TMP, type: DROPPED
                                  Source: Yara matchFile source: C:\Windows\Temp\~DF3013740FD30A6F2C.TMP, type: DROPPED
                                  Source: Yara matchFile source: C:\Windows\Temp\~DF1D4001B974C24808.TMP, type: DROPPED
                                  Source: Yara matchFile source: C:\Windows\Installer\inprogressinstallinfo.ipi, type: DROPPED
                                  Source: Yara matchFile source: C:\Windows\Temp\~DFFF3D0744094FFDB4.TMP, type: DROPPED
                                  Source: Yara matchFile source: C:\Windows\Temp\~DF2832DADE51E837D3.TMP, type: DROPPED
                                  Source: Yara matchFile source: C:\Windows\Temp\~DFAF06C0314D2ADFAB.TMP, type: DROPPED
                                  Source: Yara matchFile source: C:\Config.Msi\67a469.rbs, type: DROPPED
                                  Source: Yara matchFile source: C:\Windows\Installer\MSIA6BA.tmp, type: DROPPED
                                  Source: Yara matchFile source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exe, type: DROPPED

                                  Mitre Att&ck Matrix

                                  ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                                  Gather Victim Identity InformationAcquire Infrastructure1
                                  Valid Accounts                                  		1
                                  Native API                                  		1
                                  DLL Side-Loading                                  		1
                                  DLL Side-Loading                                  		11
                                  Disable or Modify Tools                                  		OS Credential Dumping11
                                  Peripheral Device Discovery                                  		Remote Services11
                                  Archive Collected Data                                  		22
                                  Encrypted Channel                                  		Exfiltration Over Other Network MediumAbuse Accessibility Features
                                  CredentialsDomains1
                                  Replication Through Removable Media                                  		12
                                  Command and Scripting Interpreter                                  		1
                                  DLL Search Order Hijacking                                  		1
                                  DLL Search Order Hijacking                                  		1
                                  Deobfuscate/Decode Files or Information                                  		LSASS Memory1
                                  File and Directory Discovery                                  		Remote Desktop ProtocolData from Removable Media1
                                  Non-Application Layer Protocol                                  		Exfiltration Over BluetoothNetwork Denial of Service
                                  Email AddressesDNS ServerDomain AccountsAt1
                                  Component Object Model Hijacking                                  		1
                                  Component Object Model Hijacking                                  		1
                                  Obfuscated Files or Information                                  		Security Account Manager34
                                  System Information Discovery                                  		SMB/Windows Admin SharesData from Network Shared Drive2
                                  Application Layer Protocol                                  		Automated ExfiltrationData Encrypted for Impact
                                  Employee NamesVirtual Private ServerLocal AccountsCron1
                                  Valid Accounts                                  		1
                                  Valid Accounts                                  		1
                                  Software Packing                                  		NTDS11
                                  Security Software Discovery                                  		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
                                  Gather Victim Network InformationServerCloud AccountsLaunchd2
                                  Windows Service                                  		1
                                  Access Token Manipulation                                  		1
                                  DLL Side-Loading                                  		LSA Secrets2
                                  Process Discovery                                  		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                                  Domain PropertiesBotnetReplication Through Removable MediaScheduled Task1
                                  Bootkit                                  		2
                                  Windows Service                                  		1
                                  DLL Search Order Hijacking                                  		Cached Domain Credentials61
                                  Virtualization/Sandbox Evasion                                  		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                                  DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup Items13
                                  Process Injection                                  		1
                                  File Deletion                                  		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                                  Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job22
                                  Masquerading                                  		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                                  Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
                                  Valid Accounts                                  		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                                  IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron1
                                  Access Token Manipulation                                  		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
                                  Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd61
                                  Virtualization/Sandbox Evasion                                  		Input CaptureSystem Network Connections DiscoverySoftware Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption
                                  Gather Victim Org InformationDNS ServerCompromise Software Supply ChainWindows Command ShellScheduled TaskScheduled Task13
                                  Process Injection                                  		KeyloggingProcess DiscoveryTaint Shared ContentScreen CaptureDNSExfiltration Over Physical MediumResource Hijacking
                                  Determine Physical LocationsVirtual Private ServerCompromise Hardware Supply ChainUnix ShellSystemd TimersSystemd Timers1
                                  Hidden Users                                  		GUI Input CapturePermission Groups DiscoveryReplication Through Removable MediaEmail CollectionProxyExfiltration over USBNetwork Denial of Service
                                  Business RelationshipsServerTrusted RelationshipVisual BasicContainer Orchestration JobContainer Orchestration Job1
                                  Bootkit                                  		Web Portal CaptureLocal GroupsComponent Object Model and Distributed COMLocal Email CollectionInternal ProxyCommonly Used PortDirect Network Flood
                                  Identify Business TempoBotnetHardware AdditionsPythonHypervisorProcess Injection1
                                  Rundll32                                  		Credential API HookingDomain GroupsExploitation of Remote ServicesRemote Email CollectionExternal ProxyTransfer Data to Cloud AccountReflection Amplification

                                  Behavior Graph

                                  Hide Legend

                                  Legend:

                                  • Process
                                  • Signature
                                  • Created File
                                  • DNS/IP Info
                                  • Is Dropped
                                  • Is Windows Process
                                  • Number of created Registry Values
                                  • Number of created Files
                                  • Visual Basic
                                  • Delphi
                                  • Java
                                  • .Net C# or VB.NET
                                  • C, C++ or other language
                                  • Is malicious
                                  • Internet
                                  behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1579141 Sample: NotaFiscalOnline.ClientSetu... Startdate: 20/12/2024 Architecture: WINDOWS Score: 66 55 server-ovh31444376-relay.screenconnect.com 2->55 57 instance-moi41i-relay.screenconnect.com 2->57 65 Multi AV Scanner detection for submitted file 2->65 67 .NET source code contains potential unpacker 2->67 69 .NET source code references suspicious native API functions 2->69 71 4 other signatures 2->71 8 msiexec.exe 94 48 2->8         started        12 ScreenConnect.ClientService.exe 17 23 2->12         started        15 NotaFiscalOnline.ClientSetup.ex#.exe 6 2->15         started        17 svchost.exe 2->17         started        signatures3 process4 dnsIp5 35 ScreenConnect.Wind...dentialProvider.dll, PE32+ 8->35 dropped 37 C:\...\ScreenConnect.ClientService.exe, PE32 8->37 dropped 39 C:\Windows\Installer\MSIAAC3.tmp, PE32 8->39 dropped 43 9 other files (none is malicious) 8->43 dropped 73 Enables network access during safeboot for specific services 8->73 75 Modifies security policies related information 8->75 19 msiexec.exe 8->19         started        21 msiexec.exe 1 8->21         started        23 msiexec.exe 8->23         started        59 server-ovh31444376-relay.screenconnect.com 51.89.135.228, 443, 49731, 49734 OVHFR France 12->59 77 Contains functionality to hide user accounts 12->77 79 Reads the Security eventlog 12->79 81 Reads the System eventlog 12->81 25 ScreenConnect.WindowsClient.exe 2 12->25         started        41 NotaFiscalOnline.ClientSetup.ex#.exe.log, ASCII 15->41 dropped 28 msiexec.exe 6 15->28         started        61 127.0.0.1 unknown unknown 17->61 file6 signatures7 process8 file9 31 rundll32.exe 11 19->31         started        83 Contains functionality to hide user accounts 25->83 45 C:\Users\user\AppData\Local\...\MSI9E8C.tmp, PE32 28->45 dropped signatures10 process11 file12 47 C:\Users\user\...\ScreenConnect.Windows.dll, PE32 31->47 dropped 49 C:\...\ScreenConnect.InstallerActions.dll, PE32 31->49 dropped 51 C:\Users\user\...\ScreenConnect.Core.dll, PE32 31->51 dropped 53 4 other files (none is malicious) 31->53 dropped 63 Contains functionality to hide user accounts 31->63 signatures13

                                  Screenshots

                                  Thumbnails

                                  This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                                  windows-stand

                                  Antivirus, Machine Learning and Genetic Malware Detection

                                  Initial Sample

                                  SourceDetectionScannerLabelLink
                                  NotaFiscalOnline.ClientSetup.ex#.exe18%ReversingLabsWin32.Exploit.ScreenConnectTool

                                  Dropped Files

                                  SourceDetectionScannerLabelLink
                                  C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Client.dll0%ReversingLabs
                                  C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.dll0%ReversingLabs
                                  C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe0%ReversingLabs
                                  C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Core.dll0%ReversingLabs
                                  C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Windows.dll0%ReversingLabs
                                  C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsAuthenticationPackage.dll0%ReversingLabs
                                  C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsBackstageShell.exe0%ReversingLabs
                                  C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exe0%ReversingLabs
                                  C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsCredentialProvider.dll0%ReversingLabs
                                  C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsFileManager.exe0%ReversingLabs
                                  C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp0%ReversingLabs
                                  C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp-\Microsoft.Deployment.Compression.Cab.dll0%ReversingLabs
                                  C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp-\Microsoft.Deployment.Compression.dll0%ReversingLabs
                                  C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll0%ReversingLabs
                                  C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp-\Microsoft.Deployment.WindowsInstaller.dll0%ReversingLabs
                                  C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp-\ScreenConnect.Core.dll0%ReversingLabs
                                  C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp-\ScreenConnect.InstallerActions.dll0%ReversingLabs
                                  C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp-\ScreenConnect.Windows.dll0%ReversingLabs
                                  C:\Windows\Installer\MSIA6DA.tmp0%ReversingLabs
                                  C:\Windows\Installer\MSIAAC3.tmp0%ReversingLabs

                                  Unpacked PE Files

                                  ⊘No Antivirus matches

                                  Domains

                                  ⊘No Antivirus matches

                                  URLs

                                  ⊘No Antivirus matches

                                  Domains and IPs

                                  Contacted Domains

                                  NameIPActiveMaliciousAntivirus DetectionReputation
                                  server-ovh31444376-relay.screenconnect.com
                                  		51.89.135.228
                                  		truefalse
                                    		unknown
                                    instance-moi41i-relay.screenconnect.com
                                    		unknown
                                    		unknownfalse
                                      		unknown

                                      URLs from Memory and Binaries

                                      NameSourceMaliciousAntivirus DetectionReputation
                                      http://www.apache.org/licenses/LICENSE-2.0ScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		high
                                        http://www.fontbureau.comScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		high
                                          http://www.fontbureau.com/designersGScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpfalse
                                            		high
                                            http://www.fontbureau.com/designers/?ScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpfalse
                                              		high
                                              http://instance-moi41i-relay.screenconnect.com:443/AScreenConnect.ClientService.exe, 00000007.00000002.3605920161.0000000004630000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		unknown
                                                http://www.founder.com.cn/cn/bTheScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://www.fontbureau.com/designers?ScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://instance-moi41i-relay.screenconnect.com:443/ScreenConnect.ClientService.exe, 00000007.00000002.3605920161.0000000004630000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		unknown
                                                      http://wixtoolset.org/Whttp://wixtoolset.org/telemetry/vrundll32.exe, 00000004.00000003.1745213701.0000000004F0C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1745988359.0000000004D93000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1745213701.0000000004E9D000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.4.dr, Microsoft.Deployment.Compression.dll.4.dr, Microsoft.Deployment.Compression.Cab.dll.4.drfalse
                                                        		high
                                                        https://docs.rs/getrandom#nodejs-es-module-supportScreenConnect.WindowsCredentialProvider.dll.2.drfalse
                                                          		high
                                                          http://crl.ver)svchost.exe, 00000009.00000002.3451253006.0000023127E13000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            http://www.tiro.comScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://g.live.com/odclientsettings/ProdV2.C:edb.log.9.dr, qmgr.db.9.drfalse
                                                                		high
                                                                http://www.fontbureau.com/designersScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  http://wixtoolset.org/news/rundll32.exe, 00000004.00000003.1745213701.0000000004F0C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1745988359.0000000004D93000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1745213701.0000000004E9D000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.4.dr, Microsoft.Deployment.Compression.dll.4.dr, Microsoft.Deployment.Compression.Cab.dll.4.drfalse
                                                                    		high
                                                                    http://www.goodfont.co.krScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      http://instance-moi41i-relay.screenconnect.com:443/dScreenConnect.ClientService.exe, 00000007.00000002.3578018147.0000000001367000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.3578018147.0000000001295000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.3578018147.0000000001532000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.3578018147.000000000121B000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.3578018147.0000000001487000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.3578018147.000000000133A000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.3578018147.00000000011EE000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.3578018147.00000000013E5000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.3578018147.000000000155D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                        		unknown
                                                                        http://www.carterandcone.comlScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          http://www.sajatypeworks.comScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            http://www.typography.netDScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://g.live.com/odclientsettings/Prod.C:edb.log.9.dr, qmgr.db.9.drfalse
                                                                                		high
                                                                                http://www.fontbureau.com/designers/cabarga.htmlNScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  http://www.founder.com.cn/cn/cTheScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    http://www.galapagosdesign.com/staff/dennis.htmScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      http://wixtoolset.org/releases/rundll32.exe, 00000004.00000003.1745213701.0000000004F0C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1745988359.0000000004D93000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1745213701.0000000004E9D000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.WindowsInstaller.dll.4.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.4.dr, Microsoft.Deployment.Compression.dll.4.dr, Microsoft.Deployment.Compression.Cab.dll.4.drfalse
                                                                                        		high
                                                                                        http://www.founder.com.cn/cnScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          http://www.fontbureau.com/designers/frere-user.htmlScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://g.live.com/odclientsettings/ProdV2edb.log.9.dr, qmgr.db.9.drfalse
                                                                                              		high
                                                                                              https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96svchost.exe, 00000009.00000003.1810757648.00000231280C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.drfalse
                                                                                                		high
                                                                                                http://instance-moi41i-relay.screenconnect.com:443/((instance-moi41i-relay.screenconnect.comScreenConnect.ClientService.exe, 00000007.00000002.3605920161.000000000467D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		unknown
                                                                                                  http://www.jiyu-kobo.co.jp/ScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://feedback.screenconnect.com/Feedback.axdScreenConnect.Core.dll.2.drfalse
                                                                                                      		high
                                                                                                      http://www.galapagosdesign.com/DPleaseScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        http://www.fontbureau.com/designers8ScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          http://www.fonts.comScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            http://www.sandoll.co.krScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              http://www.urwpp.deDPleaseScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                http://www.zhongyicts.com.cnScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameNotaFiscalOnline.ClientSetup.ex#.exe, 00000000.00000002.1738071402.0000000003251000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000007.00000002.3578018147.0000000001122000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    http://www.sakkal.comScreenConnect.WindowsClient.exe, 00000008.00000002.3605668922.000000001D602000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6svchost.exe, 00000009.00000003.1810757648.00000231280C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.drfalse
                                                                                                                        		high

                                                                                                                        World Map of Contacted IPs

                                                                                                                        • No. of IPs < 25%
                                                                                                                        • 25% < No. of IPs < 50%
                                                                                                                        • 50% < No. of IPs < 75%
                                                                                                                        • 75% < No. of IPs

                                                                                                                        Public IPs

                                                                                                                        IPDomainCountryFlagASNASN NameMalicious
                                                                                                                        51.89.135.228
                                                                                                                        		server-ovh31444376-relay.screenconnect.comFrance
                                                                                                                        		16276OVHFRfalse

                                                                                                                        Private

                                                                                                                        IP
                                                                                                                        127.0.0.1

                                                                                                                        General Information

                                                                                                                        Joe Sandbox version:41.0.0 Charoite
                                                                                                                        Analysis ID:1579141
                                                                                                                        Start date and time:2024-12-20 22:41:18 +01:00
                                                                                                                        Joe Sandbox product:CloudBasic
                                                                                                                        Overall analysis duration:0h 9m 40s
                                                                                                                        Hypervisor based Inspection enabled:false
                                                                                                                        Report type:full
                                                                                                                        Cookbook file name:default.jbs
                                                                                                                        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                        Run name:Run with higher sleep bypass
                                                                                                                        Number of analysed new started processes analysed:14
                                                                                                                        Number of new started drivers analysed:0
                                                                                                                        Number of existing processes analysed:0
                                                                                                                        Number of existing drivers analysed:0
                                                                                                                        Number of injected processes analysed:0
                                                                                                                        Technologies:
                                                                                                                        • HCA enabled
                                                                                                                        • EGA enabled
                                                                                                                        • AMSI enabled
                                                                                                                        Analysis Mode:default
                                                                                                                        Analysis stop reason:Timeout
                                                                                                                        Sample name:NotaFiscalOnline.ClientSetup.ex#.exe
                                                                                                                        Detection:MAL
                                                                                                                        Classification:mal66.evad.winEXE@16/66@4/2
                                                                                                                        EGA Information:
                                                                                                                        • Successful, ratio: 75%
                                                                                                                        HCA Information:
                                                                                                                        • Successful, ratio: 77%
                                                                                                                        • Number of executed functions: 237
                                                                                                                        • Number of non-executed functions: 7
                                                                                                                        Cookbook Comments:
                                                                                                                        • Found application associated with file extension: .exe
                                                                                                                        • Sleeps bigger than 100000000ms are automatically reduced to 1000ms
                                                                                                                        • Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

                                                                                                                        Warnings

                                                                                                                        • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                                                                                                                        • Excluded IPs from analysis (whitelisted): 184.28.90.27, 4.245.163.56, 13.107.246.63
                                                                                                                        • Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
                                                                                                                        • Execution Graph export aborted for target rundll32.exe, PID 7136 because it is empty
                                                                                                                        • Not all processes where analyzed, report is missing behavior information
                                                                                                                        • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                        • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                                                                        • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                                        • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                        • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                        • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                        • VT rate limit hit for: NotaFiscalOnline.ClientSetup.ex#.exe

                                                                                                                        Simulations

                                                                                                                        Behavior and APIs

                                                                                                                        ⊘No simulations

                                                                                                                        Joe Sandbox View / Context

                                                                                                                        IPs

                                                                                                                        ⊘No context

                                                                                                                        Domains

                                                                                                                        ⊘No context

                                                                                                                        ASNs

                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                        OVHFRla.bot.sparc.elfGet hashmaliciousMiraiBrowse
                                                                                                                        • 198.27.68.45
                                                                                                                        nshkmips.elfGet hashmaliciousMiraiBrowse
                                                                                                                        • 51.195.151.42
                                                                                                                        https://ho8d1o.s3.amazonaws.com/index.html?AWSAccessKeyId=AKIAWPPO57XS4BTHJAEO&Signature=h4n%2BY6bT0YHF44DbJkmJeHwDnn0%3D&Expires=1734860434#mandy.pullen@peterborough.gov.ukGet hashmaliciousFake CaptchaBrowse
                                                                                                                        • 37.59.203.111
                                                                                                                        https://p.placed.com/api/v2/sync/impression?partner=barkley&plaid=0063o000014sWgoAAE&version=1.0&payload_campaign_identifier=71700000100870630&payload_timestamp=5943094174221506287&payload_type=impression&redirect=http%3A%2F%2Fgoogle.com%2Famp%2Fs%2Fgoal.com.co%2Fwp%2FpaymentGet hashmaliciousHTMLPhisherBrowse
                                                                                                                        • 144.217.96.200
                                                                                                                        la.bot.arm.elfGet hashmaliciousMiraiBrowse
                                                                                                                        • 144.217.245.96
                                                                                                                        mipsel.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                        • 51.161.74.237
                                                                                                                        x86.elfGet hashmaliciousMirai, MoobotBrowse
                                                                                                                        • 91.121.98.217
                                                                                                                        mipsel.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                        • 164.133.159.185
                                                                                                                        mips.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                        • 51.161.242.64

                                                                                                                        JA3 Fingerprints

                                                                                                                        ⊘No context

                                                                                                                        Dropped Files

                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                        C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Client.dllfile.exeGet hashmaliciousScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, VidarBrowse
                                                                                                                          file.exeGet hashmaliciousScreenConnect Tool, Amadey, RHADAMANTHYS, XWorm, XmrigBrowse
                                                                                                                            file.exeGet hashmaliciousScreenConnect Tool, Amadey, LummaC Stealer, Vidar, XWorm, XmrigBrowse
                                                                                                                              dMDImIGmc7.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                                dMDImIGmc7.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                                  estatement020134230003.exe.virus.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                                    estatement020134230003.exe.virus.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                                      Support.ClientSetup.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                                        f53WqfzzNt.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                                          C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.dllfile.exeGet hashmaliciousScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, VidarBrowse
                                                                                                                                            file.exeGet hashmaliciousScreenConnect Tool, Amadey, RHADAMANTHYS, XWorm, XmrigBrowse
                                                                                                                                              file.exeGet hashmaliciousScreenConnect Tool, Amadey, LummaC Stealer, Vidar, XWorm, XmrigBrowse
                                                                                                                                                dMDImIGmc7.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                                                  dMDImIGmc7.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                                                    estatement020134230003.exe.virus.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                                                      estatement020134230003.exe.virus.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                                                        Support.ClientSetup.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                                                          f53WqfzzNt.exeGet hashmaliciousScreenConnect ToolBrowse

                                                                                                                                                            Created / dropped Files

                                                                                                                                                            C:\Config.Msi\67a469.rbs

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                            File Type:data
                                                                                                                                                            Category:modified
                                                                                                                                                            Size (bytes):219459
                                                                                                                                                            Entropy (8bit):6.583149824984233
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:3072:+N9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGl:+NuH2aCGw1ST1wQLdqvl
                                                                                                                                                            MD5:BBC63857A141A1D5A02F4EA793D94402
                                                                                                                                                            SHA1:F5BA19CDFFC10D0C4E568AA2C758822683DA86D8
                                                                                                                                                            SHA-256:7DEC205FBC3A055441612F767846C4021C5B9735A06FB4639AD60D8100AF144D
                                                                                                                                                            SHA-512:579C0921EAB3F819C649DE0076FE4075BD350C24D8C1292EC5E4C8B62E38D63E3A7DF90AA0904529B28C19CDD95955A1960F288236D337062075EF53CCBA7500
                                                                                                                                                            Malicious:false
                                                                                                                                                            Yara Hits:
                                                                                                                                                            • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Config.Msi\67a469.rbs, Author: Joe Security
                                                                                                                                                            Preview:...@IXOS.@.....@J..Y.@.....@.....@.....@.....@.....@......&.{8ED2474F-3FEA-BB0F-7BE5-1BCA7E4AB8D2}'.ScreenConnect Client (bc180d8c7278c2c2)..ScreenConnect.ClientSetup.msi.@.....@.....@.....@......DefaultIcon..&.{8ED2474F-3FEA-BB0F-7BE5-1BCA7E4AB8D2}.....@.....@.....@.....@.......@.....@.....@.......@....'.ScreenConnect Client (bc180d8c7278c2c2)......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{85E972A2-ADDC-AEC6-9B6B-C4279751AB13}&.{8ED2474F-3FEA-BB0F-7BE5-1BCA7E4AB8D2}.@......&.{5B8C03F1-BFD0-62EB-2AB5-F8435CB476AD}&.{8ED2474F-3FEA-BB0F-7BE5-1BCA7E4AB8D2}.@......&.{5E913D78-93D2-DBC0-0EFD-192C823FC83F}&.{8ED2474F-3FEA-BB0F-7BE5-1BCA7E4AB8D2}.@......&.{995BECE1-4834-9DF8-019C-6C6D8B4E7B7D}&.{8ED2474F-3FEA-BB0F-7BE5-1BCA7E4AB8D2}.@......&.{F1A38D30-BE35-452F-17CC-A98D5A2F5C83}&.{8ED2474F-3FEA-BB0F-7BE5-1BCA7E4AB8D2}.@......&.{B1ADF76F-7552-64FA-581A-CB09465DCE5D}&.{8ED2474F-3FEA-BB0F-7BE5

                                                                                                                                                            C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\Client.en-US.resources

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                            File Type:data
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):50133
                                                                                                                                                            Entropy (8bit):4.759054454534641
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:1536:p1+F+UTQd/3EUDv8vw+Dsj2jr0FJK97w/Leh/KR1exJKekmrg9:p1+F+UTQWUDv8vw+Dsj2jr0FJK97w/LR
                                                                                                                                                            MD5:D524E8E6FD04B097F0401B2B668DB303
                                                                                                                                                            SHA1:9486F89CE4968E03F6DCD082AA2E4C05AEF46FCC
                                                                                                                                                            SHA-256:07D04E6D5376FFC8D81AFE8132E0AA6529CCCC5EE789BEA53D56C1A2DA062BE4
                                                                                                                                                            SHA-512:E5BC6B876AFFEB252B198FEB8D213359ED3247E32C1F4BFC2C5419085CF74FE7571A51CAD4EAAAB8A44F1421F7CA87AF97C9B054BDB83F5A28FA9A880D4EFDE5
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:...........lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.q...'..6....wp.......y....C|.)>..Ldt..... $...X..........1$.../...2.%%3./>>...L.y.0.C._.........1Y..Qj.o....<....=...R..;...C....&.......1p2.r.x.u?Y..R...c......X.....I.5.2q..R...>.E.pw .@ ).w.l.....S...X..'.C.I......-.Y........4.J..P<.E..=c!.@To..#.._.2.....K.!..h...z......t......^..4...D...f..Q...:..%.z.<......^.....;<...r..yC.....Q........4_.Sns..z.......=..]t...X..<....8.e`}..n....S.H[..S@?.~....,...j.2..*v.......B....A...a......D..c..w..K,..t...S.....*v....7.6|..&.....r....#....G......Y...i..'.............'.......Z.....#2e..........|....)..%....A.....4{..u;N......&q...}.tD..x.....4...J...L......5.Q..M....K..3U..M..............5...........t.>.......lYu....3TY.?...r...'.......3.m........=.H...#.o.........n.....,4.~...<h..u...i.H...V......V/...P.$%..z...

                                                                                                                                                            C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\Client.resources

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                            File Type:data
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):26722
                                                                                                                                                            Entropy (8bit):7.7401940386372345
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:384:rAClIRkKxFCQPZhNAmutHcRIfvVf6yMt+FRVoSVCdcDk6jO0n/uTYUq5ZplYKlBy:MV3PZrXgTf6vEVm6zjpGYUElerG49
                                                                                                                                                            MD5:5CD580B22DA0C33EC6730B10A6C74932
                                                                                                                                                            SHA1:0B6BDED7936178D80841B289769C6FF0C8EEAD2D
                                                                                                                                                            SHA-256:DE185EE5D433E6CFBB2E5FCC903DBD60CC833A3CA5299F2862B253A41E7AA08C
                                                                                                                                                            SHA-512:C2494533B26128FBF8149F7D20257D78D258ABFFB30E4E595CB9C6A742F00F1BF31B1EE202D4184661B98793B9909038CF03C04B563CE4ECA1E2EE2DEC3BF787
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:...........lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP)...s^.J.....E.....(....jF.C...1P)...H..../..72J..I.J.a.K8c._.ks`.k.`.kK..m.M6p............b...P...........'...!...............K...............w.......P.......1......."A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.1.6.....$A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.2.5.6....."A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.3.2....."A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.4.8.....,A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.B.l.a.n.k.1.6.;...(A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.M.a.c.2.2.....0A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.O.p.a.q.u.e.1.9.2.8...,A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.T.i.t.l.e.1.6.....6B.l.a.n.k.M.o.n.i.t.o.r.B.a.c.k.g.r.o.u.n.d.C.o.l.o.r.4...6B.l.a.n.k.M.o.n.i.t.o.r.B.a.c.k.g.r.o.u.n.d.I.m.a.g.e.:...DB.l.a.n.k.M.o.n.i.t.o.r.B.a.c.k.g.r.o.u.n.d.I.m.a.g.e.V.i.s.i.b.l.e.xb..*B.l.a.n.k.M.o.n.i.t.o.r.T.e.x.t.C.o.l.o.r..b..*D.a.r.k.T.h.e.m.e.B.a.r.B.a.s.e.C.o.l.o.r..b..<D.a.r.k.T.h.

                                                                                                                                                            C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Client.dll

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):197120
                                                                                                                                                            Entropy (8bit):6.586775768189165
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:3072:/xLtNGTlIyS7/ObjusqVFJRJcyzvYqSmzDvJXYF:FtNGTGySabqPJYbqSmG
                                                                                                                                                            MD5:3724F06F3422F4E42B41E23ACB39B152
                                                                                                                                                            SHA1:1220987627782D3C3397D4ABF01AC3777999E01C
                                                                                                                                                            SHA-256:EA0A545F40FF491D02172228C1A39AE68344C4340A6094486A47BE746952E64F
                                                                                                                                                            SHA-512:509D9A32179A700AD76471B4CD094B8EB6D5D4AE7AD15B20FD76C482ED6D68F44693FC36BCB3999DA9346AE9E43375CD8FE02B61EDEABE4E78C4E2E44BF71D42
                                                                                                                                                            Malicious:false
                                                                                                                                                            Antivirus:
                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                            Joe Sandbox View:
                                                                                                                                                            • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                            • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                            • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                            • Filename: dMDImIGmc7.exe, Detection: malicious, Browse
                                                                                                                                                            • Filename: dMDImIGmc7.exe, Detection: malicious, Browse
                                                                                                                                                            • Filename: estatement020134230003.exe.virus.exe, Detection: malicious, Browse
                                                                                                                                                            • Filename: estatement020134230003.exe.virus.exe, Detection: malicious, Browse
                                                                                                                                                            • Filename: Support.ClientSetup.exe, Detection: malicious, Browse
                                                                                                                                                            • Filename: f53WqfzzNt.exe, Detection: malicious, Browse
                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ... ....... .......................`......#.....@.................................A...O.... ..|....................@..........8............................................ ............... ..H............text........ ...................... ..`.rsrc...|.... ......................@..@.reloc.......@......................@..B................u.......H...........4............_...... .........................................(....*..(....*^.(...........%...}....*:.(......}....*:.(......}....*:.(......}....*..{....*:.(......}....*.0..A........(....s....%.~(...%-.&~'.....y...s....%.(...(...+(...+o"...o....*....0..s.......~#.....2. ....+...j..... ......... ...............%.r...p.%.r...p............%.&...($....5..............s%....=...*..0...........~*...%-.&~).....|...s&...%.*...(...+..~+...%-.&~).....}...s(...%.+...(...+.r9..

                                                                                                                                                            C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.dll

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):68096
                                                                                                                                                            Entropy (8bit):6.06942231395039
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:1536:+A0ZscQ5V6TsQqoSD6h6+39QFVIl1zJhb8gq:p0Zy3gUOQFVQzJq
                                                                                                                                                            MD5:5DB908C12D6E768081BCED0E165E36F8
                                                                                                                                                            SHA1:F2D3160F15CFD0989091249A61132A369E44DEA4
                                                                                                                                                            SHA-256:FD5818DCDF5FC76316B8F7F96630EC66BB1CB5B5A8127CF300E5842F2C74FFCA
                                                                                                                                                            SHA-512:8400486CADB7C07C08338D8876BC14083B6F7DE8A8237F4FE866F4659139ACC0B587EB89289D281106E5BAF70187B3B5E86502A2E340113258F03994D959328D
                                                                                                                                                            Malicious:false
                                                                                                                                                            Antivirus:
                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                            Joe Sandbox View:
                                                                                                                                                            • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                            • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                            • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                            • Filename: dMDImIGmc7.exe, Detection: malicious, Browse
                                                                                                                                                            • Filename: dMDImIGmc7.exe, Detection: malicious, Browse
                                                                                                                                                            • Filename: estatement020134230003.exe.virus.exe, Detection: malicious, Browse
                                                                                                                                                            • Filename: estatement020134230003.exe.virus.exe, Detection: malicious, Browse
                                                                                                                                                            • Filename: Support.ClientSetup.exe, Detection: malicious, Browse
                                                                                                                                                            • Filename: f53WqfzzNt.exe, Detection: malicious, Browse
                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...nu............" ..0.............. ... ...@....... ..............................p.....@.................................e ..O....@.......................`..........8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................. ......H........n..@...................<.........................................(....*^.(...........%...}....*:.(......}....*:.(......}....*:.(......}....*.~,...%-.&~+.....i...s....%.,...(...+*vs....%.}P.........s....(....*....0...........s....}.....s....}...........}.......(&.....}.....(....&.()..........s....o.....()...~-...%-.&~+.....j...s....%.-...o ....s!...}.....s"...}.....s#...}...... .... 0u.........s....s=...}....... ..6........s....s=...}.....('...($............o%........

                                                                                                                                                            C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):95512
                                                                                                                                                            Entropy (8bit):6.504684691533346
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:1536:Eg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkggU0HMx790K:dhbNDxZGXfdHrX7rAc6myJkggU0HqB
                                                                                                                                                            MD5:75B21D04C69128A7230A0998086B61AA
                                                                                                                                                            SHA1:244BD68A722CFE41D1F515F5E40C3742BE2B3D1D
                                                                                                                                                            SHA-256:F1B5C000794F046259121C63ED37F9EFF0CFE1258588ECA6FD85E16D3922767E
                                                                                                                                                            SHA-512:8D51B2CD5F21C211EB8FEA4B69DC9F91DFFA7BB004D9780C701DE35EAC616E02CA30EF3882D73412F7EAB1211C5AA908338F3FA10FDF05B110F62B8ECD9D24C2
                                                                                                                                                            Malicious:true
                                                                                                                                                            Antivirus:
                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(..qF.qF.qF....qF.....qF....qF.<.B.qF.<.E.qF.<.C.qF....qF.#..qF.qG..qF.2.O.qF.2...qF.2.D.qF.Rich.qF.........................PE..L.....wc...............!.............!............@.................................>)....@.................................p...x....`..P............L...)...p......`!..p............................ ..@............................................text...:........................... ..`.rdata...f.......h..................@..@.data........@.......,..............@....rsrc...P....`.......6..............@..@.reloc.......p.......<..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                            C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Core.dll

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):548864
                                                                                                                                                            Entropy (8bit):6.034211651049746
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:12288:xC2YKhQCNc6kVTplfWL/YTHUYCBdySISYz:HhE6O7WL/EC
                                                                                                                                                            MD5:14E7489FFEBBB5A2EA500F796D881AD9
                                                                                                                                                            SHA1:0323EE0E1FAA4AA0E33FB6C6147290AA71637EBD
                                                                                                                                                            SHA-256:A2E9752DE49D18E885CBD61B29905983D44B4BC0379A244BFABDAA3188C01F0A
                                                                                                                                                            SHA-512:2110113240B7D803D8271139E0A2439DBC86AE8719ECD8B132BBDA2520F22DC3F169598C8E966AC9C0A40E617219CB8FE8AAC674904F6A1AE92D4AC1E20627CD
                                                                                                                                                            Malicious:false
                                                                                                                                                            Antivirus:
                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l............." ..0..X...........s... ........... ..............................].....@.................................as..O.......t............................r..8............................................ ............... ..H............text....W... ...X.................. ..`.rsrc...t............Z..............@..@.reloc...............^..............@..B.................s......H........C..,/..................Dr........................................{:...*..{;...*V.(<.....}:.....};...*...0..A........u~.......4.,/(=....{:....{:...o>...,.(?....{;....{;...o@...*.*.*. ... )UU.Z(=....{:...oA...X )UU.Z(?....{;...oB...X*...0..b........r...p......%..{:......%q.........-.&.+.......oC....%..{;......%q.........-.&.+.......oC....(D...*..{E...*..{F...*V.(<.....}E.....}F...*.0..A........u........4.,/(=....{E....{E...o>...,.(?....{F....{F...o@...*.*.*. F.b# )UU.

                                                                                                                                                            C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.Windows.dll

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):1721856
                                                                                                                                                            Entropy (8bit):6.639085961200334
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:24576:dx5xeYkYFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:dx5xTkYJkGYYpT0+TFiH7efP
                                                                                                                                                            MD5:9AD3964BA3AD24C42C567E47F88C82B2
                                                                                                                                                            SHA1:6B4B581FC4E3ECB91B24EC601DAA0594106BCC5D
                                                                                                                                                            SHA-256:84A09ED81AFC5FF9A17F81763C044C82A2D9E26F852DE528112153EE9AB041D0
                                                                                                                                                            SHA-512:CE557A89C0FE6DE59046116C1E262A36BBC3D561A91E44DCDA022BEF72CB75742C8B01BEDCC5B9B999E07D8DE1F94C665DD85D277E981B27B6BFEBEAF9E58097
                                                                                                                                                            Malicious:false
                                                                                                                                                            Antivirus:
                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...y............." ..0..>..........~]... ...`....... ..............................8.....@.................................+]..O....`..|............................\..8............................................ ............... ..H............text....=... ...>.................. ..`.rsrc...|....`.......@..............@..@.reloc...............D..............@..B................_]......H.......t...d..............0....\........................................()...*^.()..........%...}....*:.().....}....*:.().....}....*:.().....}....*..s*...*..s+...*:.(,.....(-...*..{....*"..}....*J.(/........(0...&*:.(,.....(1...*..{2...*"..}2...*.0..(........(3......+.............(0...&..X....i2.*v.(,....s4...}.....s5...}....*v.{.....r...p(...+.....o7....*.0...........o8....+..o9......(...+&.o....-....,..o......*..........."........{..........o:...&.......(.....*....0..L...

                                                                                                                                                            C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsAuthenticationPackage.dll

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):260168
                                                                                                                                                            Entropy (8bit):6.416438906122177
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
                                                                                                                                                            MD5:5ADCB5AE1A1690BE69FD22BDF3C2DB60
                                                                                                                                                            SHA1:09A802B06A4387B0F13BF2CDA84F53CA5BDC3785
                                                                                                                                                            SHA-256:A5B8F0070201E4F26260AF6A25941EA38BD7042AEFD48CD68B9ACF951FA99EE5
                                                                                                                                                            SHA-512:812BE742F26D0C42FDDE20AB4A02F1B47389F8D1ACAA6A5BB3409BA27C64BE444AC06D4129981B48FA02D4C06B526CB5006219541B0786F8F37CF2A183A18A73
                                                                                                                                                            Malicious:false
                                                                                                                                                            Antivirus:
                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A........................T....................V.......V.......V......................=U......=U......=U$.....=U......Rich....................PE..d.....Qf.........." ...'.^...^.......................................................(....`..........................................e.......f..P................ ......HP..........P%..p............................$..@............p...............................text...t].......^.................. ..`.rdata.......p.......b..............@..@.data....+...........d..............@....pdata... ......."...x..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................

                                                                                                                                                            C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsBackstageShell.exe

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):61208
                                                                                                                                                            Entropy (8bit):6.310126082367387
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:1536:kW/+lo6MOc8IoiKWjrNv8DtyQ4RE+TC6WAhVbb57bP8:kLlo6dccldyQGWy5s
                                                                                                                                                            MD5:AFA97CAF20F3608799E670E9D6253247
                                                                                                                                                            SHA1:7E410FDE0CA1350AA68EF478E48274888688F8EE
                                                                                                                                                            SHA-256:E25F32BA3FA32FD0DDD99EB65B26835E30829B5E4B58573690AA717E093A5D8F
                                                                                                                                                            SHA-512:FE0B378651783EF4ADD3851E12291C82EDCCDE1DBD1FA0B76D7A2C2DCD181E013B9361BBDAE4DAE946C0D45FB4BF6F75DC027F217326893C906E47041E3039B0
                                                                                                                                                            Malicious:false
                                                                                                                                                            Antivirus:
                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....c+..........."...0.................. ........@.. ....................... .......r....@.....................................O....... ................)..............8............................................ ............... ..H............text........ ...................... ..`.rsrc... ...........................@..@.reloc..............................@..B........................H........S......................x.........................................(....*^.(.......a...%...}....*:.(......}....*:.(......}....*:.(......}....*....0..........(....(....(....(....r...p(....o....(....r...p..~....(....(....r9..p..~....(....(.....g~).....(....rY..p.(....&(.....(....s....( ...s....(!...*...0...........(".....(#.....($....s....%.o%...%.o&...%.o'...%s!...o(...%~....o)...}......(....o*...o+....(,.....@...%..(.....o-....s....}.....{...........s/...o0....s....}..

                                                                                                                                                            C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsBackstageShell.exe.config

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):266
                                                                                                                                                            Entropy (8bit):4.842791478883622
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
                                                                                                                                                            MD5:728175E20FFBCEB46760BB5E1112F38B
                                                                                                                                                            SHA1:2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
                                                                                                                                                            SHA-256:87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
                                                                                                                                                            SHA-512:FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

                                                                                                                                                            C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exe

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):602392
                                                                                                                                                            Entropy (8bit):6.176232491934078
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:6144:fybAk1FVMVTZL/4TvqpU0pSdRW3akod1sI5mgve8mZXuRFtSc4q2/R4IEyxuV5AN:qbAOwJ/MvIFptJoR5NmtiFsxsFE
                                                                                                                                                            MD5:1778204A8C3BC2B8E5E4194EDBAF7135
                                                                                                                                                            SHA1:0203B65E92D2D1200DD695FE4C334955BEFBDDD3
                                                                                                                                                            SHA-256:600CF10E27311E60D32722654EF184C031A77B5AE1F8ABAE8891732710AFEE31
                                                                                                                                                            SHA-512:A902080FF8EE0D9AEFFA0B86E7980457A4E3705789529C82679766580DF0DC17535D858FBE50731E00549932F6D49011868DEE4181C6716C36379AD194B0ED69
                                                                                                                                                            Malicious:false
                                                                                                                                                            Yara Hits:
                                                                                                                                                            • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exe, Author: Joe Security
                                                                                                                                                            Antivirus:
                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0.................. ... ....@.. .......................`............@.................................M...O.... ...................)...@..........8............................................ ............... ..H............text...p.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......XJ......................$.........................................{D...*..{E...*V.(F.....}D.....}E...*...0..A........u1.......4.,/(G....{D....{D...oH...,.(I....{E....{E...oJ...*.*.*. }.o )UU.Z(G....{D...oK...X )UU.Z(I....{E...oL...X*...0..b........r...p......%..{D......%q4....4...-.&.+...4...oM....%..{E......%q5....5...-.&.+...5...oM....(N...*..{O...*..{P...*V.(F.....}O.....}P...*.0..A........u6.......4.,/(G....{O....{O...oH...,.(I....{P....{P...oJ...*.*.*. 1.c. )UU.

                                                                                                                                                            C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exe.config

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):266
                                                                                                                                                            Entropy (8bit):4.842791478883622
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
                                                                                                                                                            MD5:728175E20FFBCEB46760BB5E1112F38B
                                                                                                                                                            SHA1:2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
                                                                                                                                                            SHA-256:87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
                                                                                                                                                            SHA-512:FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

                                                                                                                                                            C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsCredentialProvider.dll

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):842248
                                                                                                                                                            Entropy (8bit):6.268561504485627
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:12288:q9vy8YABMuiAoPyEIrJs7jBjaau+EAaMVtw:P8Y4MuiAoPyZrJ8jrvDVtw
                                                                                                                                                            MD5:BE74AB7A848A2450A06DE33D3026F59E
                                                                                                                                                            SHA1:21568DCB44DF019F9FAF049D6676A829323C601E
                                                                                                                                                            SHA-256:7A80E8F654B9DDB15DDA59AC404D83DBAF4F6EAFAFA7ECBEFC55506279DE553D
                                                                                                                                                            SHA-512:2643D649A642220CEEE121038FE24EA0B86305ED8232A7E5440DFFC78270E2BDA578A619A76C5BB5A5A6FE3D9093E29817C5DF6C5DD7A8FBC2832F87AA21F0CC
                                                                                                                                                            Malicious:true
                                                                                                                                                            Antivirus:
                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}....}H..}H..}H.d~I..}H.dxIG.}H.dyI..}H..xI..}H..yI..}H..~I..}H..|H8.}H..}H..}H2.}I..}H2..I..}HRich..}H........PE..d.....Gf.........." ...'.P...........H....................................... ......q.....`......................................... ...t....................P...y.......(......,4.....T.......................(.......@............`...............................text....O.......P.................. ..`.rdata...z...`...|...T..............@..@.data....d.......0..................@....pdata...y...P...z..................@..@_RDATA...............z..............@..@.reloc..,4.......6...|..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                            C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsFileManager.exe

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):81688
                                                                                                                                                            Entropy (8bit):5.8618809599146005
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:1536:Ety9l44Kzb1I5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7j27Vy:PvqukLdn2s
                                                                                                                                                            MD5:1AEE526DC110E24D1399AFFCCD452AB3
                                                                                                                                                            SHA1:04DB0E8772933BC57364615D0D104DC2550BD064
                                                                                                                                                            SHA-256:EBD04A4540D6E76776BD58DEEA627345D0F8FBA2C04CC65BE5E979A8A67A62A1
                                                                                                                                                            SHA-512:482A8EE35D53BE907BE39DBD6C46D1F45656046BACA95630D1F07AC90A66F0E61D41F940FB166677AC4D5A48CF66C28E76D89912AED3D673A80737732E863851
                                                                                                                                                            Malicious:false
                                                                                                                                                            Antivirus:
                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....o..........."...0..@...........^... ...`....@.. .......................`.......$....@..................................^..O....`...................)...@.......]..8............................................ ............... ..H............text....>... ...@.................. ..`.rsrc........`.......B..............@..@.reloc.......@......................@..B.................^......H....... +..@2..................`]........................................(....*^.(.......;...%...}....*:.(......}....*:.(......}....*:.(......}....*....0..........s>....(....(....(....(....(.....(....(......s....}B....s....}C....~@...%-.&~?.....<...s ...%.@...o...+.....@...s ...o...+......A...s!...o...+}D.......B...s"...o...+.......(#...&......(#...& .... ...........($...&s....t......r...prs..p(%...(&...~>...%-.&...'...s(...%.>.....A...().......(*........(+...o,...(-...t....

                                                                                                                                                            C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsFileManager.exe.config

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):266
                                                                                                                                                            Entropy (8bit):4.842791478883622
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
                                                                                                                                                            MD5:728175E20FFBCEB46760BB5E1112F38B
                                                                                                                                                            SHA1:2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
                                                                                                                                                            SHA-256:87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
                                                                                                                                                            SHA-512:FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

                                                                                                                                                            C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\system.config

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with very long lines (472), with CRLF line terminators
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):962
                                                                                                                                                            Entropy (8bit):5.79919391290848
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:24:2dL9hK6E4dl/57uta7eC6vIhzQzLoI/4lBvH:chh7HH56UKCzhz+EgYBv
                                                                                                                                                            MD5:F9DCEDD27B9D662872FDB1DA7D0E3814
                                                                                                                                                            SHA1:B0C359A1DDB6DB09E6244B3ACD5446EB98EEDB7D
                                                                                                                                                            SHA-256:090D949D2ABAC1E92E36F21583F78F47946507FA057EA5BD47F681D4C3829956
                                                                                                                                                            SHA-512:DCEF7B9880F9D8A2ECA4A29BAFFA5A63AD459E03B207C39D198A814D6D34C9E468EA6DAD971E447D52391E4ED85C21A935063BA54E81AC9AF974120A13D98882
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="ClientLaunchParametersConstraint" serializeAs="String">.. <value>?h=instance-moi41i-relay.screenconnect.com&amp;p=443&amp;k=BgIAAACkAABSU0ExAAgAAAEAAQCtUXkVr37HxSNSKxbtVhrTqFy7qJEmo6oCjc91wFOvR4MUBL0kG%2fPw0Y6O4Cbp7p%2bPwDDGLRq%2fNEgwH7S00d6wq1MfdBFm9Uj%2f4fypFZ638LE3OcnK3GXv9nhEoZ1FF8a9u5e0J2AODxPEA5zAmcZC%2b7QZoOfCFaWBpymeq6yYlchLnp1mxk8YwdX7eUAaEm9dE2I95SghGZoVVq0fNyXOlQyIf5EHMgY9Z1LVbVieXeSWVl3znzwAO%2f2y0TpiXGxUUGXL5LRto6Is%2bwKhhKCzwCy3hm8ZX1L10%2fafGHE8wmaJEDg1ddSksTCut%2fYCxPRx7MSQDUTkMhfPMZ4NO3HW</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                                                                                            C:\ProgramData\Microsoft\Network\Downloader\edb.chk

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\svchost.exe
                                                                                                                                                            File Type:data
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):8192
                                                                                                                                                            Entropy (8bit):0.363788168458258
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:6:6xPoaaD0JOCEfMuaaD0JOCEfMKQmDNOxPoaaD0JOCEfMuaaD0JOCEfMKQmDN:1aaD0JcaaD0JwQQbaaD0JcaaD0JwQQ
                                                                                                                                                            MD5:0E72F896C84F1457C62C0E20338FAC0D
                                                                                                                                                            SHA1:9C071CC3D15E5BD8BF603391AE447202BD9F8537
                                                                                                                                                            SHA-256:686DC879EA8690C42D3D5D10D0148AE7110FA4D8DCCBF957FB8E41EE3D4A42B3
                                                                                                                                                            SHA-512:AAA5BE088708DABC2EC9A7A6632BDF5700BE719D3F72B732BD2DFD1A3CFDD5C8884BFA4951DB0C499AF423EC30B14A49A30FBB831D1B0A880FE10053043A4251
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:*.>...........&.....D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................................................&.............................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                            C:\ProgramData\Microsoft\Network\Downloader\edb.log

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\svchost.exe
                                                                                                                                                            File Type:data
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):1310720
                                                                                                                                                            Entropy (8bit):1.310815549768884
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrj:KooCEYhgYEL0In
                                                                                                                                                            MD5:8DBF7EDB8A47AC9272BA66FDF0BAAEA7
                                                                                                                                                            SHA1:04FCFC2184D95344AA5E83F13798977B9894FEF1
                                                                                                                                                            SHA-256:09CE54C7D31117C83F864D3C589AA5F91E2658F74C299C21EC711B53D1DE5507
                                                                                                                                                            SHA-512:CCA4FD937A28D2E8AE64DDE9568B2A2CED7048C920CABD51B73E68F073E1CBEED4F6FA45F889FDF499403B346C348DB3D00E6818DCFC46A143F5DFF78CDA5EB7
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                            C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\svchost.exe
                                                                                                                                                            File Type:Extensible storage engine DataBase, version 0x620, checksum 0x7c515e08, page size 16384, Windows version 10.0
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):1310720
                                                                                                                                                            Entropy (8bit):0.42224969795443096
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:1536:XSB2ESB2SSjlK/uedMrSU0OrsJzvqYkr3g16f2UPkLk+ku4/Iw4KKazAkUk1k2DO:Xazag03A2UrzJDO
                                                                                                                                                            MD5:27D4C96C5D603A6462AD004F04AA9BE6
                                                                                                                                                            SHA1:720B89FE90D3DA9DD06C4662410002F3BCD0DED7
                                                                                                                                                            SHA-256:581CCB0474899866BBC62AD7066AEE25075C5331648818AA3C91CBE3B6E328D6
                                                                                                                                                            SHA-512:F587AB9F1DA27E19D1AF3ACCAA14989A85B460CA6ED02C14EF2AB06F2E82EDC75F7AE8C4559D28CFA172501C4C1B1FB3C49880EDEEB9B7FF59A2ACEBEFC9E332
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:|Q^.... .......Y.......X\...;...{......................n.%.....$,...|...*...|..h.#.....$,...|..n.%.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{....................................x$,...|...................$.s$,...|...........................#......n.%.....................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                            C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\svchost.exe
                                                                                                                                                            File Type:data
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):16384
                                                                                                                                                            Entropy (8bit):0.07884046054845074
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:3:wl/UetYeFIi/EmLapovGodf/JwgL4oLqllOE/tlnl+/rTc:wbzF3HWmx5JH0oapMP
                                                                                                                                                            MD5:62D6ACCB34FFB760392803186C95E7F1
                                                                                                                                                            SHA1:2D4EDE902824B49EA8D047E769712999A6E03F43
                                                                                                                                                            SHA-256:ACEF94B2EE447CFB7C8014DDFD813123332966BABE76AFEEA369ECE582CB2823
                                                                                                                                                            SHA-512:35FCF5DA27032E0081F6C601CBA1503BD6632C5DC9A808B4C9A2C4B32C25ACFF0B45A40BFD3E42A89287ACD611B170B8977C2A514ED48CFDDB33F6313BCD3940
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:Vn.J.....................................;...{...*...|..$,...|..........$,...|..$,...|..V.3.$,...|...................$.s$,...|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NotaFiscalOnline.ClientSetup.ex#.exe.log

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exe
                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):321
                                                                                                                                                            Entropy (8bit):5.36509199858051
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTrM3RJoDLIP12MUAvvR+uCv:Q3La/KDLI4MWuPTArkvoDLI4MWuCv
                                                                                                                                                            MD5:1CF2352B684EF57925D98E766BA897F2
                                                                                                                                                            SHA1:6E8CB2C1143E9D9D1211BAA811FE4CAA49C08B55
                                                                                                                                                            SHA-256:43C3FB3C0B72A899C5442DAC8748D019D800E0A9421D3677EB96E196ED285290
                                                                                                                                                            SHA-512:9F2D6F89453C867386A65A04FF96067FC3B23A99A4BCE0ECD227E130F409069FE6DD202D4839CBF204C3F204EC058D6CDFDADA7DD212BC2356D74FEC97F22061
                                                                                                                                                            Malicious:true
                                                                                                                                                            Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):746
                                                                                                                                                            Entropy (8bit):5.349174276064173
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhaOK9eDLI4MNJK9P/JNTK9yirkvoDLb:ML9E4KlKDE4KhKiKhPKIE4oKNzKogE4P
                                                                                                                                                            MD5:ED994980CB1AABB953B2C8ECDC745E1F
                                                                                                                                                            SHA1:9E9D3E00A69FC862F4D3C30F42BF26693A2D2A21
                                                                                                                                                            SHA-256:D23B54CCF9F6327FE1158762D4E5846649699A7B78418D056A197835ED1EBE79
                                                                                                                                                            SHA-512:61DFC93154BCD734B9836A6DECF93674499FF533E2B9A1188886E2CBD04DF35538368485AA7E775B641ADC120BAE1AC2551B28647951C592AA77F6747F0E9187
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

                                                                                                                                                            C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):1088392
                                                                                                                                                            Entropy (8bit):7.789940577622617
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:24576:QUUGGHn+rUGemcPe9MpKL4Plb2sZWV+tLv0QYu5OPthT+gd:jGHpRPqMpvlqs0O4iO2k
                                                                                                                                                            MD5:8A8767F589EA2F2C7496B63D8CCC2552
                                                                                                                                                            SHA1:CC5DE8DD18E7117D8F2520A51EDB1D165CAE64B0
                                                                                                                                                            SHA-256:0918D8AB2237368A5CEC8CE99261FB07A1A1BEEDA20464C0F91AF0FE3349636B
                                                                                                                                                            SHA-512:518231213CA955ACDF37B4501FDE9C5B15806D4FC166950EB8706E8D3943947CF85324FAEE806D7DF828485597ECEFFCFA05CA1A5D8AB1BD51ED12DF963A1FE4
                                                                                                                                                            Malicious:false
                                                                                                                                                            Antivirus:
                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S.c.2.0.2.0.2.0..|0.2.0..H0.2.0.Jq0.2.0.2.0.2.0..I0.2.0..y0.2.0..x0.2.0...0.2.0Rich.2.0................PE..L...9..P...........!.........H.......i.......................................p............@..............................*..l...x....@.......................P..d.......................................@...............h............................text............................... ..`.rdata..............................@..@.data....-..........................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                            C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp-\CustomAction.config

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                            File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):234
                                                                                                                                                            Entropy (8bit):4.977464602412109
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:6:JiMVBdTMkIffVymRMT4/0xC/C7VrfC7VNQpuAW4QIT:MMHd413VymhsS+Qg93xT
                                                                                                                                                            MD5:6F52EBEA639FD7CEFCA18D9E5272463E
                                                                                                                                                            SHA1:B5E8387C2EB20DD37DF8F4A3B9B0E875FA5415E3
                                                                                                                                                            SHA-256:7027B69AB6EBC9F3F7D2F6C800793FDE2A057B76010D8CFD831CF440371B2B23
                                                                                                                                                            SHA-512:B5960066430ED40383D39365EADB3688CADADFECA382404924024C908E32C670AFABD37AB41FF9E6AC97491A5EB8B55367D7199002BF8569CF545434AB2F271A
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:.<?xml version="1.0" encoding="utf-8" ?>..<configuration>.. <startup useLegacyV2RuntimeActivationPolicy="true">.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>..</configuration>

                                                                                                                                                            C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp-\Microsoft.Deployment.Compression.Cab.dll

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):49152
                                                                                                                                                            Entropy (8bit):4.62694170304723
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:768:sqbC2wmdVdX9Y6BCH+C/FEQl2ifnxwr02Gy/G4Xux+bgHGvLw4:sAtXPC/Cifnxs02Gyu4Xu0MeR
                                                                                                                                                            MD5:77BE59B3DDEF06F08CAA53F0911608A5
                                                                                                                                                            SHA1:A3B20667C714E88CC11E845975CD6A3D6410E700
                                                                                                                                                            SHA-256:9D32032109FFC217B7DC49390BD01A067A49883843459356EBFB4D29BA696BF8
                                                                                                                                                            SHA-512:C718C1AFA95146B89FC5674574F41D994537AF21A388335A38606AEC24D6A222CBCE3E6D971DFE04D86398E607815DF63A54DA2BB96CCF80B4F52072347E1CE6
                                                                                                                                                            Malicious:false
                                                                                                                                                            Antivirus:
                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F.Y.........." ..0...... ........... ........... ...............................$....@....................................O.................................................................................... ............... ..H............text... .... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                            C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp-\Microsoft.Deployment.Compression.dll

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):36864
                                                                                                                                                            Entropy (8bit):4.340550904466943
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:384:GqJxldkxhW9N5u8IALLU0X9Z1kTOPJlqE:GqJxl6xsPIA9COxlqE
                                                                                                                                                            MD5:4717BCC62EB45D12FFBED3A35BA20E25
                                                                                                                                                            SHA1:DA6324A2965C93B70FC9783A44F869A934A9CAF7
                                                                                                                                                            SHA-256:E04DE7988A2A39931831977FA22D2A4C39CF3F70211B77B618CAE9243170F1A7
                                                                                                                                                            SHA-512:BB0ABC59104435171E27830E094EAE6781D2826ED2FC9009C8779D2CA9399E38EDB1EC6A10C1676A5AF0F7CACFB3F39AC2B45E61BE2C6A8FE0EDB1AF63A739CA
                                                                                                                                                            Malicious:false
                                                                                                                                                            Antivirus:
                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F.Y.........." ..0..`... .......~... ........... ....................................@.................................X~..O................................... }............................................... ............... ..H............text....^... ...`.................. ..`.rsrc................p..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                            C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):57344
                                                                                                                                                            Entropy (8bit):4.657268358041957
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:768:BLNru62y+VqB4N5SBcDhDxW7ZkCmX2Qv1Sf0AQdleSBRxf+xUI3:BJ2yUGmh2O11AsleyRxf+xt
                                                                                                                                                            MD5:A921A2B83B98F02D003D9139FA6BA3D8
                                                                                                                                                            SHA1:33D67E11AD96F148FD1BFD4497B4A764D6365867
                                                                                                                                                            SHA-256:548C551F6EBC5D829158A1E9AD1948D301D7C921906C3D8D6B6D69925FC624A1
                                                                                                                                                            SHA-512:E1D7556DAF571C009FE52D6FFE3D6B79923DAEEA39D754DDF6BEAFA85D7A61F3DB42DFC24D4667E35C4593F4ED6266F4099B393EFA426FA29A72108A0EAEDD3E
                                                                                                                                                            Malicious:false
                                                                                                                                                            Antivirus:
                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F.Y.........." ..0...... ........... ........... ....................... .......t....@.....................................O...................................`................................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                            C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp-\Microsoft.Deployment.WindowsInstaller.dll

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):176128
                                                                                                                                                            Entropy (8bit):5.775360792482692
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
                                                                                                                                                            MD5:5EF88919012E4A3D8A1E2955DC8C8D81
                                                                                                                                                            SHA1:C0CFB830B8F1D990E3836E0BCC786E7972C9ED62
                                                                                                                                                            SHA-256:3E54286E348EBD3D70EAED8174CCA500455C3E098CDD1FCCB167BC43D93DB29D
                                                                                                                                                            SHA-512:4544565B7D69761F9B4532CC85E7C654E591B2264EB8DA28E60A058151030B53A99D1B2833F11BFC8ACC837EECC44A7D0DBD8BC7AF97FC0E0F4938C43F9C2684
                                                                                                                                                            Malicious:false
                                                                                                                                                            Antivirus:
                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F.Y.........." ..0...... ......~.... ........... ..............................!|....@.................................,...O.................................................................................... ............... ..H............text....w... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                            C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp-\ScreenConnect.Core.dll

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):548864
                                                                                                                                                            Entropy (8bit):6.034211651049746
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:12288:xC2YKhQCNc6kVTplfWL/YTHUYCBdySISYz:HhE6O7WL/EC
                                                                                                                                                            MD5:14E7489FFEBBB5A2EA500F796D881AD9
                                                                                                                                                            SHA1:0323EE0E1FAA4AA0E33FB6C6147290AA71637EBD
                                                                                                                                                            SHA-256:A2E9752DE49D18E885CBD61B29905983D44B4BC0379A244BFABDAA3188C01F0A
                                                                                                                                                            SHA-512:2110113240B7D803D8271139E0A2439DBC86AE8719ECD8B132BBDA2520F22DC3F169598C8E966AC9C0A40E617219CB8FE8AAC674904F6A1AE92D4AC1E20627CD
                                                                                                                                                            Malicious:false
                                                                                                                                                            Antivirus:
                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l............." ..0..X...........s... ........... ..............................].....@.................................as..O.......t............................r..8............................................ ............... ..H............text....W... ...X.................. ..`.rsrc...t............Z..............@..@.reloc...............^..............@..B.................s......H........C..,/..................Dr........................................{:...*..{;...*V.(<.....}:.....};...*...0..A........u~.......4.,/(=....{:....{:...o>...,.(?....{;....{;...o@...*.*.*. ... )UU.Z(=....{:...oA...X )UU.Z(?....{;...oB...X*...0..b........r...p......%..{:......%q.........-.&.+.......oC....%..{;......%q.........-.&.+.......oC....(D...*..{E...*..{F...*V.(<.....}E.....}F...*.0..A........u........4.,/(=....{E....{E...o>...,.(?....{F....{F...o@...*.*.*. F.b# )UU.

                                                                                                                                                            C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp-\ScreenConnect.InstallerActions.dll

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):11776
                                                                                                                                                            Entropy (8bit):5.273875899788767
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:192:V8/Qp6lCJuV3jHXtyVNamVNG1YZfCrMmbfHJ7kjvLjbuLd9NEFbM64:y/cBJaLXt2NaheUrMmb/FkjvLjbuZj64
                                                                                                                                                            MD5:73A24164D8408254B77F3A2C57A22AB4
                                                                                                                                                            SHA1:EA0215721F66A93D67019D11C4E588A547CC2AD6
                                                                                                                                                            SHA-256:D727A640723D192AA3ECE213A173381682041CB28D8BD71781524DBAE3DDBF62
                                                                                                                                                            SHA-512:650D4320D9246AAECD596AC8B540BF7612EC7A8F60ECAA6E9C27B547B751386222AB926D0C915698D0BB20556475DA507895981C072852804F0B42FDDA02B844
                                                                                                                                                            Malicious:false
                                                                                                                                                            Antivirus:
                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..&...........E... ...`....... ..............................D9....@..................................D..O....`..............................$D..8............................................ ............... ..H............text...4%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc...............,..............@..B.................E......H........'.......................C........................................(....*^.(.......&...%...}....*:.(......}....*:.(......}....*:.(......}....*....0..........s.......}.....s....}.....{....r...p(......,h.{....r...p......%...(.....rS..p.(....~....%-.&~..........s....%......(...+%-.&+.(...........s....(...+&.{....o....-!.{.....{.....{....rc..po....(.....{....o.........{.....{.....{....r}..po....(.....{....o....-..{....r...p......(.....*.{....s .....-..o!.......{....r}..p.o

                                                                                                                                                            C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp-\ScreenConnect.Windows.dll

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):1721856
                                                                                                                                                            Entropy (8bit):6.639085961200334
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:24576:dx5xeYkYFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:dx5xTkYJkGYYpT0+TFiH7efP
                                                                                                                                                            MD5:9AD3964BA3AD24C42C567E47F88C82B2
                                                                                                                                                            SHA1:6B4B581FC4E3ECB91B24EC601DAA0594106BCC5D
                                                                                                                                                            SHA-256:84A09ED81AFC5FF9A17F81763C044C82A2D9E26F852DE528112153EE9AB041D0
                                                                                                                                                            SHA-512:CE557A89C0FE6DE59046116C1E262A36BBC3D561A91E44DCDA022BEF72CB75742C8B01BEDCC5B9B999E07D8DE1F94C665DD85D277E981B27B6BFEBEAF9E58097
                                                                                                                                                            Malicious:false
                                                                                                                                                            Antivirus:
                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...y............." ..0..>..........~]... ...`....... ..............................8.....@.................................+]..O....`..|............................\..8............................................ ............... ..H............text....=... ...>.................. ..`.rsrc...|....`.......@..............@..@.reloc...............D..............@..B................_]......H.......t...d..............0....\........................................()...*^.()..........%...}....*:.().....}....*:.().....}....*:.().....}....*..s*...*..s+...*:.(,.....(-...*..{....*"..}....*J.(/........(0...&*:.(,.....(1...*..{2...*"..}2...*.0..(........(3......+.............(0...&..X....i2.*v.(,....s4...}.....s5...}....*v.{.....r...p(...+.....o7....*.0...........o8....+..o9......(...+&.o....-....,..o......*..........."........{..........o:...&.......(.....*....0..L...

                                                                                                                                                            C:\Users\user\AppData\Local\Temp\ScreenConnect\24.3.7.9067\bc180d8c7278c2c2\ScreenConnect.ClientSetup.msi

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exe
                                                                                                                                                            File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Default, Author: ScreenConnect Software, Keywords: Default, Comments: Default, Template: Intel;1033, Revision Number: {8ED2474F-3FEA-BB0F-7BE5-1BCA7E4AB8D2}, Create Time/Date: Mon Oct 28 17:43:52 2024, Last Saved Time/Date: Mon Oct 28 17:43:52 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.0.1701), Security: 2
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):8241152
                                                                                                                                                            Entropy (8bit):7.950612409504629
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:98304:vwJ4t1h0cG5FGJRPxow8OzwJ4t1h0cG5hwJ4t1h0cG5lwJ4t1h0cG5:IWh0cGwSWh0cGkWh0cGUWh0cG
                                                                                                                                                            MD5:337A464F7982C06DB650F17B67400324
                                                                                                                                                            SHA1:907F81E551F0E924C0D620255532D04FFE6705C7
                                                                                                                                                            SHA-256:B026D28C32FA25A1837643B411C4CA68DF3F75C6AFF8976ACB0890FA275E0B87
                                                                                                                                                            SHA-512:06A1EEC0921CB2845B34CFDBA17741DFA006D871BAC4B40BAED707B9C1FFF142609E46910CA436CB63E7FA8BC5941905F447B5B903E90E42B51719B46F1E2460
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                            C:\Windows\Installer\67a468.msi

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                            File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Default, Author: ScreenConnect Software, Keywords: Default, Comments: Default, Template: Intel;1033, Revision Number: {8ED2474F-3FEA-BB0F-7BE5-1BCA7E4AB8D2}, Create Time/Date: Mon Oct 28 17:43:52 2024, Last Saved Time/Date: Mon Oct 28 17:43:52 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.0.1701), Security: 2
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):8241152
                                                                                                                                                            Entropy (8bit):7.950612409504629
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:98304:vwJ4t1h0cG5FGJRPxow8OzwJ4t1h0cG5hwJ4t1h0cG5lwJ4t1h0cG5:IWh0cGwSWh0cGkWh0cGUWh0cG
                                                                                                                                                            MD5:337A464F7982C06DB650F17B67400324
                                                                                                                                                            SHA1:907F81E551F0E924C0D620255532D04FFE6705C7
                                                                                                                                                            SHA-256:B026D28C32FA25A1837643B411C4CA68DF3F75C6AFF8976ACB0890FA275E0B87
                                                                                                                                                            SHA-512:06A1EEC0921CB2845B34CFDBA17741DFA006D871BAC4B40BAED707B9C1FFF142609E46910CA436CB63E7FA8BC5941905F447B5B903E90E42B51719B46F1E2460
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                            C:\Windows\Installer\67a46a.msi

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                            File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Default, Author: ScreenConnect Software, Keywords: Default, Comments: Default, Template: Intel;1033, Revision Number: {8ED2474F-3FEA-BB0F-7BE5-1BCA7E4AB8D2}, Create Time/Date: Mon Oct 28 17:43:52 2024, Last Saved Time/Date: Mon Oct 28 17:43:52 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.0.1701), Security: 2
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):8241152
                                                                                                                                                            Entropy (8bit):7.950612409504629
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:98304:vwJ4t1h0cG5FGJRPxow8OzwJ4t1h0cG5hwJ4t1h0cG5lwJ4t1h0cG5:IWh0cGwSWh0cGkWh0cGUWh0cG
                                                                                                                                                            MD5:337A464F7982C06DB650F17B67400324
                                                                                                                                                            SHA1:907F81E551F0E924C0D620255532D04FFE6705C7
                                                                                                                                                            SHA-256:B026D28C32FA25A1837643B411C4CA68DF3F75C6AFF8976ACB0890FA275E0B87
                                                                                                                                                            SHA-512:06A1EEC0921CB2845B34CFDBA17741DFA006D871BAC4B40BAED707B9C1FFF142609E46910CA436CB63E7FA8BC5941905F447B5B903E90E42B51719B46F1E2460
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                            C:\Windows\Installer\MSIA6BA.tmp

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                            File Type:data
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):423495
                                                                                                                                                            Entropy (8bit):6.578136992873003
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:6144:huH2aCGw1ST1wQLdqv5uH2aCGw1ST1wQLdqvh:huH2anwohwQUv5uH2anwohwQUvh
                                                                                                                                                            MD5:06FBF8A8EC3383A06157B9CAA2D50EE9
                                                                                                                                                            SHA1:F439C7E834B100E1C8EBBC06B612C6DD726202F6
                                                                                                                                                            SHA-256:BF476679DF270DF4BC572C4DAD005A9BF02A2FE88B3DA5B231B468FC9DAC0B1C
                                                                                                                                                            SHA-512:E7FDA38D7E73DF3D6AC1E78F0ABF75296AC7C3DE38ED9F4ED7D36A5BB6E6920AD3D5A1786B093248799E7A0751A9A0663FFB467EE1D171CB1807D9C10B7B0BFA
                                                                                                                                                            Malicious:false
                                                                                                                                                            Yara Hits:
                                                                                                                                                            • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Windows\Installer\MSIA6BA.tmp, Author: Joe Security
                                                                                                                                                            Preview:...@IXOS.@.....@J..Y.@.....@.....@.....@.....@.....@......&.{8ED2474F-3FEA-BB0F-7BE5-1BCA7E4AB8D2}'.ScreenConnect Client (bc180d8c7278c2c2)..ScreenConnect.ClientSetup.msi.@.....@.....@.....@......DefaultIcon..&.{8ED2474F-3FEA-BB0F-7BE5-1BCA7E4AB8D2}.....@.....@.....@.....@.......@.....@.....@.......@....'.ScreenConnect Client (bc180d8c7278c2c2)......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{85E972A2-ADDC-AEC6-9B6B-C4279751AB13}^.C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.dll.@.......@.....@.....@......&.{5B8C03F1-BFD0-62EB-2AB5-F8435CB476AD}f.C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsBackstageShell.exe.@.......@.....@.....@......&.{5E913D78-93D2-DBC0-0EFD-192C823FC83F}c.C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsFileMa

                                                                                                                                                            C:\Windows\Installer\MSIA6DA.tmp

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):207360
                                                                                                                                                            Entropy (8bit):6.573348437503042
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
                                                                                                                                                            MD5:BA84DD4E0C1408828CCC1DE09F585EDA
                                                                                                                                                            SHA1:E8E10065D479F8F591B9885EA8487BC673301298
                                                                                                                                                            SHA-256:3CFF4AC91288A0FF0C13278E73B282A64E83D089C5A61A45D483194AB336B852
                                                                                                                                                            SHA-512:7A38418F6EE8DBC66FAB2CD5AD8E033E761912EFC465DAA484858D451DA4B8576079FE90FD3B6640410EDC8B3CAC31C57719898134F246F4000D60A252D88290
                                                                                                                                                            Malicious:false
                                                                                                                                                            Antivirus:
                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                            Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........AF../.../.../.'D..../.'D..../.'D..../...,.../...+.../...*.../......./......./.....n./.*.*.../.*./.../.*...../....../.*.-.../.Rich../.........................PE..L...pG.Y...........!.........L......&.....................................................@.................................P........P..x....................`......P...T...............................@...............<............................text...+........................... ..`.rdata..*...........................@..@.data...."... ......................@....rsrc...x....P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                            C:\Windows\Installer\MSIAAC3.tmp

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                            File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):207360
                                                                                                                                                            Entropy (8bit):6.573348437503042
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
                                                                                                                                                            MD5:BA84DD4E0C1408828CCC1DE09F585EDA
                                                                                                                                                            SHA1:E8E10065D479F8F591B9885EA8487BC673301298
                                                                                                                                                            SHA-256:3CFF4AC91288A0FF0C13278E73B282A64E83D089C5A61A45D483194AB336B852
                                                                                                                                                            SHA-512:7A38418F6EE8DBC66FAB2CD5AD8E033E761912EFC465DAA484858D451DA4B8576079FE90FD3B6640410EDC8B3CAC31C57719898134F246F4000D60A252D88290
                                                                                                                                                            Malicious:false
                                                                                                                                                            Antivirus:
                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                            Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........AF../.../.../.'D..../.'D..../.'D..../...,.../...+.../...*.../......./......./.....n./.*.*.../.*./.../.*...../....../.*.-.../.Rich../.........................PE..L...pG.Y...........!.........L......&.....................................................@.................................P........P..x....................`......P...T...............................@...............<............................text...+........................... ..`.rdata..*...........................@..@.data...."... ......................@....rsrc...x....P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                            C:\Windows\Installer\SourceHash{8ED2474F-3FEA-BB0F-7BE5-1BCA7E4AB8D2}

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                            File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):20480
                                                                                                                                                            Entropy (8bit):1.1712693479727259
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:12:JSbX72Fj+qAGiLIlHVRpIh/7777777777777777777777777vDHFalHiPnw7rl0G:J4qQI5wo9KnbF
                                                                                                                                                            MD5:B04BBBA15011F76B4D7C9965DE4E24DE
                                                                                                                                                            SHA1:023687160096F9FC4796576AC5D0F0114BAD4224
                                                                                                                                                            SHA-256:D80B6414E76CEAAB91264B00D7BBC013B226050A4B0891B22759831F02189F29
                                                                                                                                                            SHA-512:C45213D4AF375EEFE00D0B522C8C2A347113CCD64041D04BAC9AEA560A1255E6E3D55B1542A86103274C0FCBB428F29AA4B3BC9531C24C2578DBA9742C3A3033
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                            C:\Windows\Installer\inprogressinstallinfo.ipi

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                            File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):20480
                                                                                                                                                            Entropy (8bit):1.8036953343895008
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:48:7W8PhMuRc06WXzujT5C9UBAqcq56Adu7SiGjindFGeKeaahIyYCfnto5r2Adu7SI:7phM1zjTPlp6fMqdFG5ahIwb
                                                                                                                                                            MD5:7EDE4054852750852F7BFB2A6C3B2391
                                                                                                                                                            SHA1:8EEDAB54533CEAB6DC2FC4182FBD14AC2B00B15B
                                                                                                                                                            SHA-256:04C5674D952162E1EFB764165D58BA21B6C732B4F1216D48973509C859B56A9F
                                                                                                                                                            SHA-512:31E49BBD61341B640064E9BA4B76680D830FEDF7DE3CAE03076873BB9E30B7375745FDA83433CCDC135966AA5D3908708D335C04A42BB63F1E41018CDB013543
                                                                                                                                                            Malicious:false
                                                                                                                                                            Yara Hits:
                                                                                                                                                            • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Windows\Installer\inprogressinstallinfo.ipi, Author: Joe Security
                                                                                                                                                            Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                            C:\Windows\Installer\{8ED2474F-3FEA-BB0F-7BE5-1BCA7E4AB8D2}\DefaultIcon

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                            File Type:MS Windows icon resource - 3 icons, 16x16 with PNG image data, 16 x 16, 8-bit colormap, non-interlaced, 4 bits/pixel, 32x32 with PNG image data, 32 x 32, 1-bit colormap, non-interlaced, 4 bits/pixel
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):435
                                                                                                                                                            Entropy (8bit):5.289734780210945
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:12:Kvv/7tghWPjScQZ/Ev/739Jgh5TZYR/v/71XfghNeZ:QOZZq9JOz0dONeZ
                                                                                                                                                            MD5:F34D51C3C14D1B4840AE9FF6B70B5D2F
                                                                                                                                                            SHA1:C761D3EF26929F173CEB2F8E01C6748EE2249A8A
                                                                                                                                                            SHA-256:0DD459D166F037BB8E531EB2ECEB2B79DE8DBBD7597B05A03C40B9E23E51357A
                                                                                                                                                            SHA-512:D6EEB5345A5A049A87BFBFBBBEBFBD9FBAEC7014DA41DB1C706E8B16DDEC31561679AAE9E8A0847098807412BD1306B9616C8E6FCFED8683B4F33BD05ADE38D1
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:..............z...6... ..............00..........0....PNG........IHDR.............(-.S....PLTE....22.u......tRNS.@..f..."IDATx.c` .0"...$.(......SC..Q8....9b.i.Xa.....IEND.B`..PNG........IHDR... ... .....I......PLTE....22.u......tRNS.@..f...(IDATx.c`...... ... D.......vb.....A`..(.-s...q....IEND.B`..PNG........IHDR...0...0.....m.k.....PLTE....22.u......tRNS.@..f...+IDATx.c` .......Q...S.@..DQu...4...(.}DQD...3x........IEND.B`.

                                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                            File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):432221
                                                                                                                                                            Entropy (8bit):5.375174934074321
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgauy:zTtbmkExhMJCIpErf
                                                                                                                                                            MD5:F32E0F11B428AEFF1C3975500F37E60E
                                                                                                                                                            SHA1:65A572E7D94BFCAD1A49B41AD87975763B54C0A3
                                                                                                                                                            SHA-256:08867EA7B7442A8B4E87BAF180AF5B75878145D09DB1986F648BDEDF2D34BED0
                                                                                                                                                            SHA-512:0811D7B1F536E37E730C64C8C3E10D83273E099789CA4502D4260A8E77798E1D77186EA40ACFF51742D3E49F9BA9ADBF432DF35EB389784CD1D2375C0E1E44B2
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

                                                                                                                                                            C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\svchost.exe
                                                                                                                                                            File Type:JSON data
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):55
                                                                                                                                                            Entropy (8bit):4.306461250274409
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
                                                                                                                                                            MD5:DCA83F08D448911A14C22EBCACC5AD57
                                                                                                                                                            SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                                                                                                                                                            SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                                                                                                                                                            SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

                                                                                                                                                            C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\3gd2ltu3.newcfg

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe
                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):584
                                                                                                                                                            Entropy (8bit):5.013890864457484
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlbSe69ip3jw/vXbAa3xT:2dL9hK6E46YPRbTKidivH
                                                                                                                                                            MD5:C19405684938D0666EE0BA6BCE9E3C42
                                                                                                                                                            SHA1:590994BACB33CB761D4852E84F60EAD589EE50C2
                                                                                                                                                            SHA-256:1BFCC0988FEFD4CA679B431F7769D689A5C2161C5B71E79098B5468C1E4218F1
                                                                                                                                                            SHA-512:B54D9350C04950FE5418997A43F6E328BED798A3268862ED3BAC0F9CEF7221E6FCAFB21A8AA623BC3C91A01D354F95044FB09D14CC672A6557E10680F9F0729D
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-moi41i-relay.screenconnect.com=51.89.135.228-20%2f12%2f2024%2021%3a44%3a01</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                                                                                            C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\4n225xi3.newcfg

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe
                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):584
                                                                                                                                                            Entropy (8bit):5.012808784927091
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlbSe69ip3a/vXbAa3xT:2dL9hK6E46YPRbTKidwvH
                                                                                                                                                            MD5:E2F35053D72753266B1F002A02E91FC1
                                                                                                                                                            SHA1:6080A8AABAF05CEA96390813DE994E458E0E3B1C
                                                                                                                                                            SHA-256:BD4C2A486D74B373168E9BAE42690F7CAE64E538E9F878429A4A13D4EFBDAE92
                                                                                                                                                            SHA-512:BA57B1E22709354C098898CCEA12731C6881DD1B8E7014E90C363073751D6004A4DCECC5807264633C769357F6EF20C2EAC997C30CEC9970E7E700B2B95D87E2
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-moi41i-relay.screenconnect.com=51.89.135.228-20%2f12%2f2024%2021%3a42%3a23</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                                                                                            C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\n3gwxb5y.newcfg

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe
                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):584
                                                                                                                                                            Entropy (8bit):5.015130979668883
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlbSe69ip3S/vXbAa3xT:2dL9hK6E46YPRbTKidYvH
                                                                                                                                                            MD5:605CA9A28547C9947FD8D6293868522E
                                                                                                                                                            SHA1:601C6CE617DD24D43798C74B5005C0A5E8083D6E
                                                                                                                                                            SHA-256:8E2E53E28CD46661399BDC12922811196F06A47431F53EB96AC833713455949B
                                                                                                                                                            SHA-512:07632F7C21C053F6D2708906EEEFBA22DF6F4D7AD5A3DC70D49F2D15AFA9E2494EB8F4F87441871B866E203F5B520050B43DFB53C8D2D5386AADEDF4CD13791C
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-moi41i-relay.screenconnect.com=51.89.135.228-20%2f12%2f2024%2021%3a42%3a38</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                                                                                            C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\qvsa1fyj.newcfg

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe
                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):584
                                                                                                                                                            Entropy (8bit):5.013865782629225
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlbSe69ip3B5/vXbAa3xT:2dL9hK6E46YPRbTKidBRvH
                                                                                                                                                            MD5:307E8A85FC40B2CE5A90982D89AD0204
                                                                                                                                                            SHA1:F4A56B3E2EE2E1F27B60A32D7DE25E76C09339B9
                                                                                                                                                            SHA-256:C49E2E36E4C06E1549DA9D2CA002EAFE01A305D717757455B3E720C72A66C775
                                                                                                                                                            SHA-512:7777FB9F0428C813633AAF945A580C99D01AF53DBB9FD22E2F2C1872D2011984E83F6AF0F1957A11708DCCC90655E6BDE9DE5AE38EE495A30730362669117FF3
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-moi41i-relay.screenconnect.com=51.89.135.228-20%2f12%2f2024%2021%3a42%3a31</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                                                                                            C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\snm44ufm.newcfg

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe
                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):584
                                                                                                                                                            Entropy (8bit):5.015565018616194
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlbSe69ip3We/vXbAa3xT:2dL9hK6E46YPRbTKid7vH
                                                                                                                                                            MD5:2F471C0688466A313B469AB1127C479A
                                                                                                                                                            SHA1:B9AC4645BA0FF9FBDE794502EADF951E67614863
                                                                                                                                                            SHA-256:5CCF65584E430871E29400EEA525DCF169A623F1B11856B69887D49B6779294D
                                                                                                                                                            SHA-512:E1E69FFA0A8E172833A0BDBFED6E17551AA5F20138C4D4DEAF4E29C4BAD9AC308E9832E1EE922A72112428F96A8CB7D2184D5BDAA8D6948F7372AB35A463233D
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-moi41i-relay.screenconnect.com=51.89.135.228-20%2f12%2f2024%2021%3a42%3a26</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                                                                                            C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\user.config (copy)

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe
                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):584
                                                                                                                                                            Entropy (8bit):5.0115435878874335
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlbSe69ip3/w/vXbAa3xT:2dL9hK6E46YPRbTKid+vH
                                                                                                                                                            MD5:0F00CED0346818A39A76CD2F00BAFD6E
                                                                                                                                                            SHA1:CC7DFD4AEF500CCEA4445D35E824CD83B494ED09
                                                                                                                                                            SHA-256:AAE78856E4756E403874816063C98D8BFD4A40A6131F28FDBA9EFD280F3B6942
                                                                                                                                                            SHA-512:113B36979D7975CF9494EAFDA04393D9612B92E77E738FDF3976448E17612E39B3A88EBC743B04479F26B57882180FA6B96F0A7CC98F1D8098D69EA462D75B89
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-moi41i-relay.screenconnect.com=51.89.135.228-20%2f12%2f2024%2021%3a42%3a21</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                                                                                            C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\x3aodwuh.newcfg

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe
                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):584
                                                                                                                                                            Entropy (8bit):5.0115435878874335
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlbSe69ip3/w/vXbAa3xT:2dL9hK6E46YPRbTKid+vH
                                                                                                                                                            MD5:0F00CED0346818A39A76CD2F00BAFD6E
                                                                                                                                                            SHA1:CC7DFD4AEF500CCEA4445D35E824CD83B494ED09
                                                                                                                                                            SHA-256:AAE78856E4756E403874816063C98D8BFD4A40A6131F28FDBA9EFD280F3B6942
                                                                                                                                                            SHA-512:113B36979D7975CF9494EAFDA04393D9612B92E77E738FDF3976448E17612E39B3A88EBC743B04479F26B57882180FA6B96F0A7CC98F1D8098D69EA462D75B89
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-moi41i-relay.screenconnect.com=51.89.135.228-20%2f12%2f2024%2021%3a42%3a21</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                                                                                            C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\xopi4msf.newcfg

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe
                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):584
                                                                                                                                                            Entropy (8bit):5.015130979668883
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlbSe69ip34f/vXbAa3xT:2dL9hK6E46YPRbTKidAvH
                                                                                                                                                            MD5:6C76B1BA8DE89DB247CBD520874DCCAE
                                                                                                                                                            SHA1:F53DA48133923987D07EA0C2C11561780F949EB7
                                                                                                                                                            SHA-256:BC745CFAB878A8183CF5E3575786FD866904056C13292030A3DD3A74762758E2
                                                                                                                                                            SHA-512:5F856F93A73B68FE52ACD81E332A4F845D455DC611F41BA8A9C14DD7BB445AC30C3EA8F4EEB6032BFC59611120115CDEFF64FDFDE6987C348924436485C91047
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-moi41i-relay.screenconnect.com=51.89.135.228-20%2f12%2f2024%2021%3a43%3a28</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                                                                                            C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\z5ox3kh0.newcfg

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe
                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):584
                                                                                                                                                            Entropy (8bit):5.015156061497142
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlbSe69ip34fm/vXbAa3xT:2dL9hK6E46YPRbTKidO8vH
                                                                                                                                                            MD5:FC4113156BCEA2215ADF800470218B52
                                                                                                                                                            SHA1:910019364DCA303CA0E23642092187CE67213101
                                                                                                                                                            SHA-256:3C5153C89C1C9E0B0F88A70D35938EAD801DC2776752BA9DB07E20C76CE9EA60
                                                                                                                                                            SHA-512:FCBF5C60E565D1F5729D1273F28904215864CBC77D24D73D2B56D5388CE4F0DBA940387B907A14B2980D47B23C0C122AE36315862DC2CC1AE0C88A275BD33911
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-moi41i-relay.screenconnect.com=51.89.135.228-20%2f12%2f2024%2021%3a43%3a03</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                                                                                            C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\zgsk4twd.newcfg

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe
                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):584
                                                                                                                                                            Entropy (8bit):5.015257750081806
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlbSe69ip3y/vXbAa3xT:2dL9hK6E46YPRbTKid4vH
                                                                                                                                                            MD5:059D189447D833CFBC81A2B0D4628A23
                                                                                                                                                            SHA1:8ABD5861262968157EF01C15669A47C019AB7B18
                                                                                                                                                            SHA-256:F586511809F863AC5F6A213CA1850272432C1A944A5B578BF3167AB5B44C35CB
                                                                                                                                                            SHA-512:7D1336D8143C7EB85C2C0DBE001E1D4000EB4E5E1A4EAC2120419042D4FE0EAE211B333B46761F99F1847BB36EC0F4CE33A45148882D104942A0E9C6923A3C8D
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-moi41i-relay.screenconnect.com=51.89.135.228-20%2f12%2f2024%2021%3a42%3a49</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                                                                                            C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc180d8c7278c2c2)\zkzbnecy.newcfg

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe
                                                                                                                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                            Category:modified
                                                                                                                                                            Size (bytes):584
                                                                                                                                                            Entropy (8bit):5.017355055529923
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONlbSe69ip3//vXbAa3xT:2dL9hK6E46YPRbTKidHvH
                                                                                                                                                            MD5:43BAD4C7E4D936831F8B9D9D636ED79A
                                                                                                                                                            SHA1:4F8344515CFAA7EB89D5E6FAB51AC38CB206F9A3
                                                                                                                                                            SHA-256:B934BCFEBD42D34096A3AE3C0082DF842BB0F0B8E74C23F1B98BA24EAF7959CC
                                                                                                                                                            SHA-512:AFAB704FF72E1D37C835CD3C0DD02B63F8512E4283FCFF3B2BF1AEDFD000D6094399C7475A9E396DD0A430FD12C9B4AFF2B3E41DF3BA911D14AE982F951DB24F
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-moi41i-relay.screenconnect.com=51.89.135.228-20%2f12%2f2024%2021%3a44%3a59</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                                                                                            C:\Windows\Temp\~DF0D867F6250DB2F08.TMP

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                            File Type:data
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):512
                                                                                                                                                            Entropy (8bit):0.0
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:3::
                                                                                                                                                            MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                            SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                            SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                            SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                            C:\Windows\Temp\~DF1D4001B974C24808.TMP

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                            File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):32768
                                                                                                                                                            Entropy (8bit):1.4229180848551604
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:48:dpkuwrh8FXzJT5aU69UBAqcq56Adu7SiGjindFGeKeaahIyYCfnto5r2Adu7SIDB:/kM3ToQlp6fMqdFG5ahIwb
                                                                                                                                                            MD5:4534D53568CEF4F256F5F6945B9D991F
                                                                                                                                                            SHA1:AD285B4BA331F810DF0A6AB108F31892B02E7D7C
                                                                                                                                                            SHA-256:BDC37D6A1D523B10541EE8A00D0E1E735B6141CE78998114F77093C8D743279E
                                                                                                                                                            SHA-512:4D81A3AA61088E26F801FD357EDAE8297FB7C5DF46F835000CCFECCE516F1836D22F189C7CA283153222BAC91BEA95C27BF18E40BEFE778A9D8FA0B06D670321
                                                                                                                                                            Malicious:false
                                                                                                                                                            Yara Hits:
                                                                                                                                                            • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Windows\Temp\~DF1D4001B974C24808.TMP, Author: Joe Security
                                                                                                                                                            Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                            C:\Windows\Temp\~DF249EB05BDFDBCBF4.TMP

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                            File Type:data
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):512
                                                                                                                                                            Entropy (8bit):0.0
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:3::
                                                                                                                                                            MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                            SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                            SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                            SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                            C:\Windows\Temp\~DF2832DADE51E837D3.TMP

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                            File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):32768
                                                                                                                                                            Entropy (8bit):1.4229180848551604
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:48:dpkuwrh8FXzJT5aU69UBAqcq56Adu7SiGjindFGeKeaahIyYCfnto5r2Adu7SIDB:/kM3ToQlp6fMqdFG5ahIwb
                                                                                                                                                            MD5:4534D53568CEF4F256F5F6945B9D991F
                                                                                                                                                            SHA1:AD285B4BA331F810DF0A6AB108F31892B02E7D7C
                                                                                                                                                            SHA-256:BDC37D6A1D523B10541EE8A00D0E1E735B6141CE78998114F77093C8D743279E
                                                                                                                                                            SHA-512:4D81A3AA61088E26F801FD357EDAE8297FB7C5DF46F835000CCFECCE516F1836D22F189C7CA283153222BAC91BEA95C27BF18E40BEFE778A9D8FA0B06D670321
                                                                                                                                                            Malicious:false
                                                                                                                                                            Yara Hits:
                                                                                                                                                            • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Windows\Temp\~DF2832DADE51E837D3.TMP, Author: Joe Security
                                                                                                                                                            Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                            C:\Windows\Temp\~DF3013740FD30A6F2C.TMP

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                            File Type:data
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):69632
                                                                                                                                                            Entropy (8bit):0.23556650008208885
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:48:vDDBAdu7S3qcq56Adu7SiGjindFGeKeaahIyYCfnto5rBH9U:hxp6fMqdFG5ahIwE
                                                                                                                                                            MD5:EA3C597A2B097F574747BC6DF7EE8ABA
                                                                                                                                                            SHA1:6CFE9F830726DDE5D35ED23DB8A2D1E8577D8C3E
                                                                                                                                                            SHA-256:79195CDAF989574E7ED48857AF2120F9206CE1393D2CF8507F20AE107D9C5368
                                                                                                                                                            SHA-512:3104B4D823C8642AD1A0E6928B4983C0FCA1F7692E373B47D460E2730C2CEEB905043B5B14CB64E6C05B9D2B48AD4BE367C58AB2CCD0E1D0E5E5CD04271463B3
                                                                                                                                                            Malicious:false
                                                                                                                                                            Yara Hits:
                                                                                                                                                            • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Windows\Temp\~DF3013740FD30A6F2C.TMP, Author: Joe Security
                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                            C:\Windows\Temp\~DF3C72D8D4580D21DC.TMP

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                            File Type:data
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):512
                                                                                                                                                            Entropy (8bit):0.0
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:3::
                                                                                                                                                            MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                            SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                            SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                            SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                            C:\Windows\Temp\~DF726D17E3AFC4398F.TMP

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                            File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):20480
                                                                                                                                                            Entropy (8bit):1.8036953343895008
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:48:7W8PhMuRc06WXzujT5C9UBAqcq56Adu7SiGjindFGeKeaahIyYCfnto5r2Adu7SI:7phM1zjTPlp6fMqdFG5ahIwb
                                                                                                                                                            MD5:7EDE4054852750852F7BFB2A6C3B2391
                                                                                                                                                            SHA1:8EEDAB54533CEAB6DC2FC4182FBD14AC2B00B15B
                                                                                                                                                            SHA-256:04C5674D952162E1EFB764165D58BA21B6C732B4F1216D48973509C859B56A9F
                                                                                                                                                            SHA-512:31E49BBD61341B640064E9BA4B76680D830FEDF7DE3CAE03076873BB9E30B7375745FDA83433CCDC135966AA5D3908708D335C04A42BB63F1E41018CDB013543
                                                                                                                                                            Malicious:false
                                                                                                                                                            Yara Hits:
                                                                                                                                                            • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Windows\Temp\~DF726D17E3AFC4398F.TMP, Author: Joe Security
                                                                                                                                                            Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                            C:\Windows\Temp\~DF7AEA098548F5A07B.TMP

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                            File Type:data
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):32768
                                                                                                                                                            Entropy (8bit):0.07739083401354742
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:6:2/9LG7iVCnLG7iVrKOzPLHKOQPhNrFdoEh0PnVSKChiVky6l51:2F0i8n0itFzDHFalHiPnw7r
                                                                                                                                                            MD5:A72C608F1AC83D045BCCC28290D9BA0B
                                                                                                                                                            SHA1:4F42DF074BB1863C0278F6CD74D537F2EFD3DBAF
                                                                                                                                                            SHA-256:4150C7A8C2D24BEC061E1047EA0647C94935E6D4828EE80721C0E472E7FE132D
                                                                                                                                                            SHA-512:8BD0C0883EDEAD19FC040C5C8DC53686D49843ECDCD26FDD7E42921C009CB605DCE7B6D3AB6C4B6DC9FA78CF449F79B73AF12B4FE6BBE7CF2DAE460DDD15A83B
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                            C:\Windows\Temp\~DF9378F42FEC2E686C.TMP

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                            File Type:data
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):512
                                                                                                                                                            Entropy (8bit):0.0
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:3::
                                                                                                                                                            MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                            SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                            SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                            SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                            C:\Windows\Temp\~DFAF06C0314D2ADFAB.TMP

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                            File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):20480
                                                                                                                                                            Entropy (8bit):1.8036953343895008
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:48:7W8PhMuRc06WXzujT5C9UBAqcq56Adu7SiGjindFGeKeaahIyYCfnto5r2Adu7SI:7phM1zjTPlp6fMqdFG5ahIwb
                                                                                                                                                            MD5:7EDE4054852750852F7BFB2A6C3B2391
                                                                                                                                                            SHA1:8EEDAB54533CEAB6DC2FC4182FBD14AC2B00B15B
                                                                                                                                                            SHA-256:04C5674D952162E1EFB764165D58BA21B6C732B4F1216D48973509C859B56A9F
                                                                                                                                                            SHA-512:31E49BBD61341B640064E9BA4B76680D830FEDF7DE3CAE03076873BB9E30B7375745FDA83433CCDC135966AA5D3908708D335C04A42BB63F1E41018CDB013543
                                                                                                                                                            Malicious:false
                                                                                                                                                            Yara Hits:
                                                                                                                                                            • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Windows\Temp\~DFAF06C0314D2ADFAB.TMP, Author: Joe Security
                                                                                                                                                            Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                            C:\Windows\Temp\~DFC53E78444F94571D.TMP

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                            File Type:data
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):512
                                                                                                                                                            Entropy (8bit):0.0
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:3::
                                                                                                                                                            MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                            SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                            SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                            SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                            Malicious:false
                                                                                                                                                            Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                            C:\Windows\Temp\~DFFF3D0744094FFDB4.TMP

                                                                                                                                                            Download File
                                                                                                                                                            Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                            File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                            Category:dropped
                                                                                                                                                            Size (bytes):32768
                                                                                                                                                            Entropy (8bit):1.4229180848551604
                                                                                                                                                            Encrypted:false
                                                                                                                                                            SSDEEP:48:dpkuwrh8FXzJT5aU69UBAqcq56Adu7SiGjindFGeKeaahIyYCfnto5r2Adu7SIDB:/kM3ToQlp6fMqdFG5ahIwb
                                                                                                                                                            MD5:4534D53568CEF4F256F5F6945B9D991F
                                                                                                                                                            SHA1:AD285B4BA331F810DF0A6AB108F31892B02E7D7C
                                                                                                                                                            SHA-256:BDC37D6A1D523B10541EE8A00D0E1E735B6141CE78998114F77093C8D743279E
                                                                                                                                                            SHA-512:4D81A3AA61088E26F801FD357EDAE8297FB7C5DF46F835000CCFECCE516F1836D22F189C7CA283153222BAC91BEA95C27BF18E40BEFE778A9D8FA0B06D670321
                                                                                                                                                            Malicious:false
                                                                                                                                                            Yara Hits:
                                                                                                                                                            • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Windows\Temp\~DFFF3D0744094FFDB4.TMP, Author: Joe Security
                                                                                                                                                            Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                            Static File Info

                                                                                                                                                            General

                                                                                                                                                            File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                            Entropy (8bit):7.4294521087631065
                                                                                                                                                            TrID:
                                                                                                                                                            • Win32 Executable (generic) Net Framework (10011505/4) 50.01%
                                                                                                                                                            • Win32 Executable (generic) a (10002005/4) 49.97%
                                                                                                                                                            • Generic Win/DOS Executable (2004/3) 0.01%
                                                                                                                                                            • DOS Executable Generic (2002/1) 0.01%
                                                                                                                                                            • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                            File name:NotaFiscalOnline.ClientSetup.ex#.exe
                                                                                                                                                            File size:5'620'152 bytes
                                                                                                                                                            MD5:6172d1fc5570bc73675ba4dd05772a6e
                                                                                                                                                            SHA1:407aa98fe89d23a8b0fd3b9f448ee11bcf028c41
                                                                                                                                                            SHA256:564370d9522a479a4ed5c2a9b18f66e289e51e2dbf3ce3920fc3e0ad99e25046
                                                                                                                                                            SHA512:c29d535b32a7dfaa6b4a9fc863dcdbdf92165c39cff5a62e1570b31874c661164e146e4c2cd50e41afc71713cf37ea7fd0beceda35e7e77954f326fc470ede8b
                                                                                                                                                            SSDEEP:49152:kEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:tEs6efPNwJ4t1h0cG5FGJRPxow8O
                                                                                                                                                            TLSH:DE46E111B3DA95B9D4BF063CD87A82699A74BC044712C7EF53D4BD2D2D32BC05A323A6
                                                                                                                                                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_..E>`.E>`.E>`.....O>`.....?>`.....]>`..Ee.`>`..Ed.T>`..Ec.Q>`.LF..A>`.[l..F>`.E>a.%>`..Ei.D>`..E..D>`..Eb.D>`.RichE>`........

                                                                                                                                                            File Icon

                                                                                                                                                            Icon Hash:90cececece8e8eb0

                                                                                                                                                            Static PE Info

                                                                                                                                                            General

                                                                                                                                                            Entrypoint:0x4014ad
                                                                                                                                                            Entrypoint Section:.text
                                                                                                                                                            Digitally signed:true
                                                                                                                                                            Imagebase:0x400000
                                                                                                                                                            Subsystem:windows gui
                                                                                                                                                            Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                                                                                            DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                                                                                                                            Time Stamp:0x6377E6AC [Fri Nov 18 20:10:20 2022 UTC]
                                                                                                                                                            TLS Callbacks:
                                                                                                                                                            CLR (.Net) Version:
                                                                                                                                                            OS Version Major:5
                                                                                                                                                            OS Version Minor:1
                                                                                                                                                            File Version Major:5
                                                                                                                                                            File Version Minor:1
                                                                                                                                                            Subsystem Version Major:5
                                                                                                                                                            Subsystem Version Minor:1
                                                                                                                                                            Import Hash:9771ee6344923fa220489ab01239bdfd

                                                                                                                                                            Authenticode Signature

                                                                                                                                                            Signature Valid:true
                                                                                                                                                            Signature Issuer:CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
                                                                                                                                                            Signature Validation Error:The operation completed successfully
                                                                                                                                                            Error Number:0
                                                                                                                                                            Not Before, Not After
                                                                                                                                                            • 17/08/2022 01:00:00 16/08/2025 00:59:59
                                                                                                                                                            Subject Chain
                                                                                                                                                            • CN="Connectwise, LLC", O="Connectwise, LLC", L=Tampa, S=Florida, C=US
                                                                                                                                                            Version:3
                                                                                                                                                            Thumbprint MD5:AAE704EC2810686C3BF7704E660AFB5D
                                                                                                                                                            Thumbprint SHA-1:4C2272FBA7A7380F55E2A424E9E624AEE1C14579
                                                                                                                                                            Thumbprint SHA-256:82B4E7924D5BED84FB16DDF8391936EB301479CEC707DC14E23BC22B8CDEAE28
                                                                                                                                                            Serial:0B9360051BCCF66642998998D5BA97CE

                                                                                                                                                            Entrypoint Preview

                                                                                                                                                            Instruction
                                                                                                                                                            call 00007F01E082886Ah
                                                                                                                                                            jmp 00007F01E082831Fh
                                                                                                                                                            push ebp
                                                                                                                                                            mov ebp, esp
                                                                                                                                                            push 00000000h
                                                                                                                                                            call dword ptr [0040D040h]
                                                                                                                                                            push dword ptr [ebp+08h]
                                                                                                                                                            call dword ptr [0040D03Ch]
                                                                                                                                                            push C0000409h
                                                                                                                                                            call dword ptr [0040D044h]
                                                                                                                                                            push eax
                                                                                                                                                            call dword ptr [0040D048h]
                                                                                                                                                            pop ebp
                                                                                                                                                            ret
                                                                                                                                                            push ebp
                                                                                                                                                            mov ebp, esp
                                                                                                                                                            sub esp, 00000324h
                                                                                                                                                            push 00000017h
                                                                                                                                                            call dword ptr [0040D04Ch]
                                                                                                                                                            test eax, eax
                                                                                                                                                            je 00007F01E08284A7h
                                                                                                                                                            push 00000002h
                                                                                                                                                            pop ecx
                                                                                                                                                            int 29h
                                                                                                                                                            mov dword ptr [004148D8h], eax
                                                                                                                                                            mov dword ptr [004148D4h], ecx
                                                                                                                                                            mov dword ptr [004148D0h], edx
                                                                                                                                                            mov dword ptr [004148CCh], ebx
                                                                                                                                                            mov dword ptr [004148C8h], esi
                                                                                                                                                            mov dword ptr [004148C4h], edi
                                                                                                                                                            mov word ptr [004148F0h], ss
                                                                                                                                                            mov word ptr [004148E4h], cs
                                                                                                                                                            mov word ptr [004148C0h], ds
                                                                                                                                                            mov word ptr [004148BCh], es
                                                                                                                                                            mov word ptr [004148B8h], fs
                                                                                                                                                            mov word ptr [004148B4h], gs
                                                                                                                                                            pushfd
                                                                                                                                                            pop dword ptr [004148E8h]
                                                                                                                                                            mov eax, dword ptr [ebp+00h]
                                                                                                                                                            mov dword ptr [004148DCh], eax
                                                                                                                                                            mov eax, dword ptr [ebp+04h]
                                                                                                                                                            mov dword ptr [004148E0h], eax
                                                                                                                                                            lea eax, dword ptr [ebp+08h]
                                                                                                                                                            mov dword ptr [004148ECh], eax
                                                                                                                                                            mov eax, dword ptr [ebp-00000324h]
                                                                                                                                                            mov dword ptr [00414828h], 00010001h

                                                                                                                                                            Rich Headers

                                                                                                                                                            Programming Language:
                                                                                                                                                            • [IMP] VS2008 SP1 build 30729
                                                                                                                                                            • [IMP] VS2008 build 21022

                                                                                                                                                            Data Directories

                                                                                                                                                            NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_IMPORT0x129c40x50.rdata
                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0x160000x533074.rsrc
                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_SECURITY0x5462000x15fb8
                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x54a0000xea8.reloc
                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_DEBUG0x11f200x70.rdata
                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x11e600x40.rdata
                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_IAT0xd0000x13c.rdata
                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                            Sections

                                                                                                                                                            NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                            .text0x10000xb1af0xb200d9fa6da0baf4b869720be833223490cbFalse0.6123156601123596data6.592039633797327IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                            .rdata0xd0000x60780x62008b45a1035c0de72f910a75db7749f735False0.41549744897959184data4.786621464556291IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                            .data0x140000x11e40x8001f4cc86b6735a74429c9d1feb93e2871False0.18310546875data2.265083745848167IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                            .rsrc0x160000x5330740x533200d813d73373778ed5b0a4b71b252379ebunknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                            .reloc0x54a0000xea80x1000a93b0f39998e1e69e5944da8c5ff06b1False0.72265625data6.301490309336801IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                            Resources

                                                                                                                                                            NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                            FILES0x163d40x86000PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows0.3962220149253731
                                                                                                                                                            FILES0x9c3d40x1a4600PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows0.5111589431762695
                                                                                                                                                            FILES0x2409d40x1ac00PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows0.4415066442757009
                                                                                                                                                            FILES0x25b5d40x2ec318PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows0.9810924530029297
                                                                                                                                                            FILES0x5478ec0x1600PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows0.3908025568181818
                                                                                                                                                            RT_MANIFEST0x548eec0x188XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.5892857142857143

                                                                                                                                                            Imports

                                                                                                                                                            DLLImport
                                                                                                                                                            mscoree.dllCorBindToRuntimeEx
                                                                                                                                                            KERNEL32.dllGetModuleFileNameA, DecodePointer, SizeofResource, LockResource, LoadLibraryW, LoadResource, FindResourceW, GetProcAddress, WriteConsoleW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, FlushFileBuffers, HeapReAlloc, HeapSize, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, RtlUnwind, GetLastError, SetLastError, EncodePointer, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, RaiseException, GetStdHandle, WriteFile, CreateFileW, MultiByteToWideChar, WideCharToMultiByte, ExitProcess, GetModuleHandleExW, GetACP, CloseHandle, HeapAlloc, HeapFree, FindClose, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, LCMapStringW, SetStdHandle, GetFileType, GetStringTypeW, GetProcessHeap
                                                                                                                                                            OLEAUT32.dllVariantInit, SafeArrayUnaccessData, SafeArrayCreateVector, SafeArrayDestroy, VariantClear, SafeArrayAccessData

                                                                                                                                                            Possible Origin

                                                                                                                                                            Language of compilation systemCountry where language is spokenMap
                                                                                                                                                            EnglishUnited States

                                                                                                                                                            Network Behavior

                                                                                                                                                            Network Port Distribution

                                                                                                                                                            TCP Packets

                                                                                                                                                            TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                            Dec 20, 2024 22:42:22.055794001 CET49731443192.168.2.451.89.135.228
                                                                                                                                                            Dec 20, 2024 22:42:22.055898905 CET4434973151.89.135.228192.168.2.4
                                                                                                                                                            Dec 20, 2024 22:42:22.056008101 CET49731443192.168.2.451.89.135.228
                                                                                                                                                            Dec 20, 2024 22:42:22.598448038 CET49731443192.168.2.451.89.135.228
                                                                                                                                                            Dec 20, 2024 22:42:22.598479986 CET4434973151.89.135.228192.168.2.4
                                                                                                                                                            Dec 20, 2024 22:42:22.598539114 CET4434973151.89.135.228192.168.2.4
                                                                                                                                                            Dec 20, 2024 22:42:24.688460112 CET49734443192.168.2.451.89.135.228
                                                                                                                                                            Dec 20, 2024 22:42:24.688561916 CET4434973451.89.135.228192.168.2.4
                                                                                                                                                            Dec 20, 2024 22:42:24.688673973 CET49734443192.168.2.451.89.135.228
                                                                                                                                                            Dec 20, 2024 22:42:24.690757990 CET49734443192.168.2.451.89.135.228
                                                                                                                                                            Dec 20, 2024 22:42:24.690784931 CET4434973451.89.135.228192.168.2.4
                                                                                                                                                            Dec 20, 2024 22:42:24.690834045 CET4434973451.89.135.228192.168.2.4
                                                                                                                                                            Dec 20, 2024 22:42:27.458214045 CET49736443192.168.2.451.89.135.228
                                                                                                                                                            Dec 20, 2024 22:42:27.458303928 CET4434973651.89.135.228192.168.2.4
                                                                                                                                                            Dec 20, 2024 22:42:27.458415985 CET49736443192.168.2.451.89.135.228
                                                                                                                                                            Dec 20, 2024 22:42:27.461735010 CET49736443192.168.2.451.89.135.228
                                                                                                                                                            Dec 20, 2024 22:42:27.461762905 CET4434973651.89.135.228192.168.2.4
                                                                                                                                                            Dec 20, 2024 22:42:27.461812019 CET4434973651.89.135.228192.168.2.4
                                                                                                                                                            Dec 20, 2024 22:42:32.267199039 CET49740443192.168.2.451.89.135.228
                                                                                                                                                            Dec 20, 2024 22:42:32.267237902 CET4434974051.89.135.228192.168.2.4
                                                                                                                                                            Dec 20, 2024 22:42:32.267688990 CET49740443192.168.2.451.89.135.228
                                                                                                                                                            Dec 20, 2024 22:42:32.269567013 CET49740443192.168.2.451.89.135.228
                                                                                                                                                            Dec 20, 2024 22:42:32.269579887 CET4434974051.89.135.228192.168.2.4
                                                                                                                                                            Dec 20, 2024 22:42:32.269634962 CET4434974051.89.135.228192.168.2.4
                                                                                                                                                            Dec 20, 2024 22:42:39.101840019 CET49746443192.168.2.451.89.135.228
                                                                                                                                                            Dec 20, 2024 22:42:39.101895094 CET4434974651.89.135.228192.168.2.4
                                                                                                                                                            Dec 20, 2024 22:42:39.101986885 CET49746443192.168.2.451.89.135.228
                                                                                                                                                            Dec 20, 2024 22:42:39.111258984 CET49746443192.168.2.451.89.135.228
                                                                                                                                                            Dec 20, 2024 22:42:39.111277103 CET4434974651.89.135.228192.168.2.4
                                                                                                                                                            Dec 20, 2024 22:42:39.111341000 CET4434974651.89.135.228192.168.2.4
                                                                                                                                                            Dec 20, 2024 22:42:50.593966007 CET49747443192.168.2.451.89.135.228
                                                                                                                                                            Dec 20, 2024 22:42:50.594053030 CET4434974751.89.135.228192.168.2.4
                                                                                                                                                            Dec 20, 2024 22:42:50.594335079 CET49747443192.168.2.451.89.135.228
                                                                                                                                                            Dec 20, 2024 22:42:50.596352100 CET49747443192.168.2.451.89.135.228
                                                                                                                                                            Dec 20, 2024 22:42:50.596436977 CET4434974751.89.135.228192.168.2.4
                                                                                                                                                            Dec 20, 2024 22:42:50.596537113 CET4434974751.89.135.228192.168.2.4
                                                                                                                                                            Dec 20, 2024 22:43:04.735378981 CET49748443192.168.2.451.89.135.228
                                                                                                                                                            Dec 20, 2024 22:43:04.735450029 CET4434974851.89.135.228192.168.2.4
                                                                                                                                                            Dec 20, 2024 22:43:04.735544920 CET49748443192.168.2.451.89.135.228
                                                                                                                                                            Dec 20, 2024 22:43:04.738033056 CET49748443192.168.2.451.89.135.228
                                                                                                                                                            Dec 20, 2024 22:43:04.738068104 CET4434974851.89.135.228192.168.2.4
                                                                                                                                                            Dec 20, 2024 22:43:04.738174915 CET4434974851.89.135.228192.168.2.4
                                                                                                                                                            Dec 20, 2024 22:43:29.511662006 CET49795443192.168.2.451.89.135.228
                                                                                                                                                            Dec 20, 2024 22:43:29.511713982 CET4434979551.89.135.228192.168.2.4
                                                                                                                                                            Dec 20, 2024 22:43:29.511805058 CET49795443192.168.2.451.89.135.228
                                                                                                                                                            Dec 20, 2024 22:43:29.514286041 CET49795443192.168.2.451.89.135.228
                                                                                                                                                            Dec 20, 2024 22:43:29.514302015 CET4434979551.89.135.228192.168.2.4
                                                                                                                                                            Dec 20, 2024 22:43:29.514357090 CET4434979551.89.135.228192.168.2.4
                                                                                                                                                            Dec 20, 2024 22:44:02.652362108 CET49869443192.168.2.451.89.135.228
                                                                                                                                                            Dec 20, 2024 22:44:02.652410984 CET4434986951.89.135.228192.168.2.4
                                                                                                                                                            Dec 20, 2024 22:44:02.652484894 CET49869443192.168.2.451.89.135.228
                                                                                                                                                            Dec 20, 2024 22:44:02.654700041 CET49869443192.168.2.451.89.135.228
                                                                                                                                                            Dec 20, 2024 22:44:02.654720068 CET4434986951.89.135.228192.168.2.4
                                                                                                                                                            Dec 20, 2024 22:44:02.654762983 CET4434986951.89.135.228192.168.2.4
                                                                                                                                                            Dec 20, 2024 22:45:00.144351959 CET50000443192.168.2.451.89.135.228
                                                                                                                                                            Dec 20, 2024 22:45:00.144439936 CET4435000051.89.135.228192.168.2.4
                                                                                                                                                            Dec 20, 2024 22:45:00.144529104 CET50000443192.168.2.451.89.135.228
                                                                                                                                                            Dec 20, 2024 22:45:00.146898031 CET50000443192.168.2.451.89.135.228
                                                                                                                                                            Dec 20, 2024 22:45:00.146931887 CET4435000051.89.135.228192.168.2.4
                                                                                                                                                            Dec 20, 2024 22:45:00.146971941 CET4435000051.89.135.228192.168.2.4

                                                                                                                                                            UDP Packets

                                                                                                                                                            TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                            Dec 20, 2024 22:42:21.729748011 CET5086353192.168.2.41.1.1.1
                                                                                                                                                            Dec 20, 2024 22:42:22.023626089 CET53508631.1.1.1192.168.2.4
                                                                                                                                                            Dec 20, 2024 22:43:04.422947884 CET6376053192.168.2.41.1.1.1
                                                                                                                                                            Dec 20, 2024 22:43:04.723141909 CET53637601.1.1.1192.168.2.4
                                                                                                                                                            Dec 20, 2024 22:44:02.327708006 CET6280853192.168.2.41.1.1.1
                                                                                                                                                            Dec 20, 2024 22:44:02.640866995 CET53628081.1.1.1192.168.2.4
                                                                                                                                                            Dec 20, 2024 22:44:59.844974041 CET4918053192.168.2.41.1.1.1
                                                                                                                                                            Dec 20, 2024 22:45:00.134264946 CET53491801.1.1.1192.168.2.4

                                                                                                                                                            DNS Queries

                                                                                                                                                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                            Dec 20, 2024 22:42:21.729748011 CET192.168.2.41.1.1.10xc380Standard query (0)instance-moi41i-relay.screenconnect.comA (IP address)IN (0x0001)false
                                                                                                                                                            Dec 20, 2024 22:43:04.422947884 CET192.168.2.41.1.1.10x26fbStandard query (0)instance-moi41i-relay.screenconnect.comA (IP address)IN (0x0001)false
                                                                                                                                                            Dec 20, 2024 22:44:02.327708006 CET192.168.2.41.1.1.10x1cbfStandard query (0)instance-moi41i-relay.screenconnect.comA (IP address)IN (0x0001)false
                                                                                                                                                            Dec 20, 2024 22:44:59.844974041 CET192.168.2.41.1.1.10x345dStandard query (0)instance-moi41i-relay.screenconnect.comA (IP address)IN (0x0001)false

                                                                                                                                                            DNS Answers

                                                                                                                                                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                            Dec 20, 2024 22:42:22.023626089 CET1.1.1.1192.168.2.40xc380No error (0)instance-moi41i-relay.screenconnect.comserver-ovh31444376-relay.screenconnect.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                            Dec 20, 2024 22:42:22.023626089 CET1.1.1.1192.168.2.40xc380No error (0)server-ovh31444376-relay.screenconnect.com51.89.135.228A (IP address)IN (0x0001)false
                                                                                                                                                            Dec 20, 2024 22:43:04.723141909 CET1.1.1.1192.168.2.40x26fbNo error (0)instance-moi41i-relay.screenconnect.comserver-ovh31444376-relay.screenconnect.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                            Dec 20, 2024 22:43:04.723141909 CET1.1.1.1192.168.2.40x26fbNo error (0)server-ovh31444376-relay.screenconnect.com51.89.135.228A (IP address)IN (0x0001)false
                                                                                                                                                            Dec 20, 2024 22:44:02.640866995 CET1.1.1.1192.168.2.40x1cbfNo error (0)instance-moi41i-relay.screenconnect.comserver-ovh31444376-relay.screenconnect.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                            Dec 20, 2024 22:44:02.640866995 CET1.1.1.1192.168.2.40x1cbfNo error (0)server-ovh31444376-relay.screenconnect.com51.89.135.228A (IP address)IN (0x0001)false
                                                                                                                                                            Dec 20, 2024 22:45:00.134264946 CET1.1.1.1192.168.2.40x345dNo error (0)instance-moi41i-relay.screenconnect.comserver-ovh31444376-relay.screenconnect.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                            Dec 20, 2024 22:45:00.134264946 CET1.1.1.1192.168.2.40x345dNo error (0)server-ovh31444376-relay.screenconnect.com51.89.135.228A (IP address)IN (0x0001)false

                                                                                                                                                            Statistics

                                                                                                                                                            CPU Usage

                                                                                                                                                            Click to jump to process

                                                                                                                                                            Memory Usage

                                                                                                                                                            Click to jump to process

                                                                                                                                                            High Level Behavior Distribution

                                                                                                                                                            Click to dive into process behavior distribution

                                                                                                                                                            Behavior

                                                                                                                                                            Click to jump to process

                                                                                                                                                            System Behavior

                                                                                                                                                            General

                                                                                                                                                            Target ID:0
                                                                                                                                                            Start time:16:42:14
                                                                                                                                                            Start date:20/12/2024
                                                                                                                                                            Path:C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exe
                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                            Commandline:"C:\Users\user\Desktop\NotaFiscalOnline.ClientSetup.ex#.exe"
                                                                                                                                                            Imagebase:0xb40000
                                                                                                                                                            File size:5'620'152 bytes
                                                                                                                                                            MD5 hash:6172D1FC5570BC73675BA4DD05772A6E
                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                            Yara matches:
                                                                                                                                                            • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000000.00000002.1764992488.0000000005B80000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                            • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000000.00000000.1727146343.0000000000B56000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                                                                                            Reputation:low
                                                                                                                                                            Has exited:true

                                                                                                                                                            General

                                                                                                                                                            Target ID:1
                                                                                                                                                            Start time:16:42:15
                                                                                                                                                            Start date:20/12/2024
                                                                                                                                                            Path:C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                            Commandline:"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ScreenConnect\24.3.7.9067\bc180d8c7278c2c2\ScreenConnect.ClientSetup.msi"
                                                                                                                                                            Imagebase:0x580000
                                                                                                                                                            File size:59'904 bytes
                                                                                                                                                            MD5 hash:9D09DC1EDA745A5F87553048E57620CF
                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                            Reputation:high
                                                                                                                                                            Has exited:true

                                                                                                                                                            General

                                                                                                                                                            Target ID:2
                                                                                                                                                            Start time:16:42:15
                                                                                                                                                            Start date:20/12/2024
                                                                                                                                                            Path:C:\Windows\System32\msiexec.exe
                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                            Commandline:C:\Windows\system32\msiexec.exe /V
                                                                                                                                                            Imagebase:0x7ff78acc0000
                                                                                                                                                            File size:69'632 bytes
                                                                                                                                                            MD5 hash:E5DA170027542E25EDE42FC54C929077
                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                            Reputation:high
                                                                                                                                                            Has exited:false

                                                                                                                                                            General

                                                                                                                                                            Target ID:3
                                                                                                                                                            Start time:16:42:16
                                                                                                                                                            Start date:20/12/2024
                                                                                                                                                            Path:C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                            Commandline:C:\Windows\syswow64\MsiExec.exe -Embedding FDD3F5775BCF411E2F2CE6AD00C803EA C
                                                                                                                                                            Imagebase:0x580000
                                                                                                                                                            File size:59'904 bytes
                                                                                                                                                            MD5 hash:9D09DC1EDA745A5F87553048E57620CF
                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                            Reputation:high
                                                                                                                                                            Has exited:true

                                                                                                                                                            General

                                                                                                                                                            Target ID:4
                                                                                                                                                            Start time:16:42:16
                                                                                                                                                            Start date:20/12/2024
                                                                                                                                                            Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                            Commandline:rundll32.exe "C:\Users\user\AppData\Local\Temp\MSI9E8C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_6790984 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                                                                                                                                                            Imagebase:0xdc0000
                                                                                                                                                            File size:61'440 bytes
                                                                                                                                                            MD5 hash:889B99C52A60DD49227C5E485A016679
                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                            Reputation:high
                                                                                                                                                            Has exited:true

                                                                                                                                                            General

                                                                                                                                                            Target ID:5
                                                                                                                                                            Start time:16:42:18
                                                                                                                                                            Start date:20/12/2024
                                                                                                                                                            Path:C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                            Commandline:C:\Windows\syswow64\MsiExec.exe -Embedding DFEAB60EF0EE39131070D55D2010EA08
                                                                                                                                                            Imagebase:0x580000
                                                                                                                                                            File size:59'904 bytes
                                                                                                                                                            MD5 hash:9D09DC1EDA745A5F87553048E57620CF
                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                            Reputation:high
                                                                                                                                                            Has exited:true

                                                                                                                                                            General

                                                                                                                                                            Target ID:6
                                                                                                                                                            Start time:16:42:19
                                                                                                                                                            Start date:20/12/2024
                                                                                                                                                            Path:C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                            Commandline:C:\Windows\syswow64\MsiExec.exe -Embedding 3D95DD263ED99317D709E6688C830EBF E Global\MSI0000
                                                                                                                                                            Imagebase:0x580000
                                                                                                                                                            File size:59'904 bytes
                                                                                                                                                            MD5 hash:9D09DC1EDA745A5F87553048E57620CF
                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                            Reputation:high
                                                                                                                                                            Has exited:true

                                                                                                                                                            General

                                                                                                                                                            Target ID:7
                                                                                                                                                            Start time:16:42:19
                                                                                                                                                            Start date:20/12/2024
                                                                                                                                                            Path:C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe
                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                            Commandline:"C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-moi41i-relay.screenconnect.com&p=443&s=1d8f6587-f572-4c0d-ac4f-19f114aa9e8c&k=BgIAAACkAABSU0ExAAgAAAEAAQCtUXkVr37HxSNSKxbtVhrTqFy7qJEmo6oCjc91wFOvR4MUBL0kG%2fPw0Y6O4Cbp7p%2bPwDDGLRq%2fNEgwH7S00d6wq1MfdBFm9Uj%2f4fypFZ638LE3OcnK3GXv9nhEoZ1FF8a9u5e0J2AODxPEA5zAmcZC%2b7QZoOfCFaWBpymeq6yYlchLnp1mxk8YwdX7eUAaEm9dE2I95SghGZoVVq0fNyXOlQyIf5EHMgY9Z1LVbVieXeSWVl3znzwAO%2f2y0TpiXGxUUGXL5LRto6Is%2bwKhhKCzwCy3hm8ZX1L10%2fafGHE8wmaJEDg1ddSksTCut%2fYCxPRx7MSQDUTkMhfPMZ4NO3HW"
                                                                                                                                                            Imagebase:0x130000
                                                                                                                                                            File size:95'512 bytes
                                                                                                                                                            MD5 hash:75B21D04C69128A7230A0998086B61AA
                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                            Antivirus matches:
                                                                                                                                                            • Detection: 0%, ReversingLabs
                                                                                                                                                            Reputation:moderate
                                                                                                                                                            Has exited:false

                                                                                                                                                            General

                                                                                                                                                            Target ID:8
                                                                                                                                                            Start time:16:42:20
                                                                                                                                                            Start date:20/12/2024
                                                                                                                                                            Path:C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exe
                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                            Commandline:"C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exe" "RunRole" "fa6d27a7-f258-47e2-8bd0-25ba01636377" "User"
                                                                                                                                                            Imagebase:0x8a0000
                                                                                                                                                            File size:602'392 bytes
                                                                                                                                                            MD5 hash:1778204A8C3BC2B8E5E4194EDBAF7135
                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                            Yara matches:
                                                                                                                                                            • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000008.00000000.1788207411.00000000008A2000.00000002.00000001.01000000.00000011.sdmp, Author: Joe Security
                                                                                                                                                            • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000008.00000002.3577450968.0000000002B11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                            • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Program Files (x86)\ScreenConnect Client (bc180d8c7278c2c2)\ScreenConnect.WindowsClient.exe, Author: Joe Security
                                                                                                                                                            Antivirus matches:
                                                                                                                                                            • Detection: 0%, ReversingLabs
                                                                                                                                                            Reputation:moderate
                                                                                                                                                            Has exited:false

                                                                                                                                                            General

                                                                                                                                                            Target ID:9
                                                                                                                                                            Start time:16:42:22
                                                                                                                                                            Start date:20/12/2024
                                                                                                                                                            Path:C:\Windows\System32\svchost.exe
                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                            Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                                            Imagebase:0x7ff6eef20000
                                                                                                                                                            File size:55'320 bytes
                                                                                                                                                            MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                            Reputation:high
                                                                                                                                                            Has exited:true

                                                                                                                                                            Disassembly

                                                                                                                                                            Reset < >

                                                                                                                                                              Execution Graph

                                                                                                                                                              Execution Coverage:14.7%
                                                                                                                                                              Dynamic/Decrypted Code Coverage:100%
                                                                                                                                                              Signature Coverage:20%
                                                                                                                                                              Total number of Nodes:25
                                                                                                                                                              Total number of Limit Nodes:1
                                                                                                                                                              execution_graph 28297 17b18d8 28298 17b18e8 28297->28298 28301 17b19e0 28298->28301 28299 17b1935 28302 17b19fb 28301->28302 28305 17b41e0 28301->28305 28310 17b41f0 28301->28310 28302->28299 28306 17b420f 28305->28306 28307 17b43ed 28306->28307 28315 5b414b0 28306->28315 28319 5b414c0 28306->28319 28311 17b420f 28310->28311 28312 17b43ed 28311->28312 28313 5b414b0 RtlGetVersion 28311->28313 28314 5b414c0 RtlGetVersion 28311->28314 28313->28312 28314->28312 28316 5b414ce 28315->28316 28317 5b414d4 28315->28317 28323 5b42d07 28316->28323 28317->28307 28320 5b414ce 28319->28320 28321 5b414d4 28319->28321 28322 5b42d07 RtlGetVersion 28320->28322 28321->28307 28322->28321 28324 5b42d1d 28323->28324 28325 5b42f0c RtlGetVersion 28324->28325 28326 5b42e2c 28324->28326 28327 5b42fca 28325->28327 28326->28317 28327->28317

                                                                                                                                                              Executed Functions

                                                                                                                                                              Function 05B42D07 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 230COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 66 5b42d07-5b42de6 79 5b42e58-5b42e6d 66->79 80 5b42de8-5b42dfc 66->80 87 5b42ead-5b42ec8 79->87 88 5b42e6f-5b42e8b 79->88 83 5b42e02 80->83 84 5b42dfe-5b42e00 80->84 85 5b42e05-5b42e26 call 5b42560 83->85 84->85 97 5b42e2c-5b42e57 85->97 98 5b42ef8-5b42fc8 RtlGetVersion 85->98 93 5b42eca-5b42ece 87->93 100 5b42e95-5b42eab 88->100 101 5b42e8d 88->101 95 5b42ed0 93->95 96 5b42ed9 93->96 95->96 96->98 108 5b42fd1-5b43014 98->108 109 5b42fca-5b42fd0 98->109 100->93 101->100 113 5b43016 108->113 114 5b4301b-5b43022 108->114 109->108 113->114
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764464634.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b40000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: LR^q$`Q^q$`Q^q
                                                                                                                                                              • API String ID: 0-1747521512
                                                                                                                                                              • Opcode ID: baf4164acfbf8f1bc1fc2a15116a4ef494e7b77618ee70acaef3527474e91bb6
                                                                                                                                                              • Instruction ID: 929fd05e3e305c09d07f8aa1df55b518deb91f30e5596ae1154e26f00fd5bbe1
                                                                                                                                                              • Opcode Fuzzy Hash: baf4164acfbf8f1bc1fc2a15116a4ef494e7b77618ee70acaef3527474e91bb6
                                                                                                                                                              • Instruction Fuzzy Hash: F3813430A043A49FDB119F68C8287EABFB2EF45304F0440DAD449DB391DB74A948CB96
                                                                                                                                                              Function 05B4BA30 Relevance: 6.9, Strings: 5, Instructions: 625COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 115 5b4ba30-5b4bad2 call 5b4ba30 call 5b4b318 * 2 call 5b4a9b8 130 5b4bbb4-5b4bbbe 115->130 131 5b4bad8-5b4bada 115->131 132 5b4bae0-5b4bae6 131->132 133 5b4bbbf-5b4bc1f 131->133 134 5b4bc26-5b4bc8b 132->134 135 5b4baec-5b4bafe 132->135 133->134 158 5b4bc8c-5b4bcb0 134->158 140 5b4bb70-5b4bbae call 5b4b794 135->140 141 5b4bb00-5b4bb68 135->141 140->130 140->131 141->140 163 5b4bcb2-5b4bcc3 158->163 164 5b4bcc9-5b4bcca 158->164 163->164 164->158 165 5b4bccc-5b4bcdc 164->165 167 5b4bce4-5b4bcec 165->167 168 5b4bda0-5b4bda9 167->168 169 5b4bdb4-5b4bdbb 168->169 170 5b4bdab-5b4bdae 168->170 172 5b4bdc1-5b4be00 call 5b4b318 169->172 173 5b4bf9f-5b4bfa8 169->173 170->169 171 5b4bcf1-5b4bcfd 170->171 174 5b4bd03-5b4bd1c 171->174 175 5b4bfa9-5b4c01d 171->175 193 5b4be02-5b4be07 172->193 194 5b4be09-5b4be16 172->194 180 5b4bd93-5b4bd9d 174->180 181 5b4bd1e-5b4bd8b 174->181 203 5b4c023-5b4c042 175->203 204 5b4c1bd-5b4c1c7 175->204 180->168 181->180 197 5b4be19-5b4be56 call 5b4a9b8 193->197 194->197 207 5b4bf90-5b4bf99 197->207 208 5b4c044-5b4c0a3 call 5b4b318 203->208 209 5b4c0ab-5b4c0ba 203->209 207->173 210 5b4be5b-5b4be9a 207->210 208->209 209->204 214 5b4c0c0-5b4c0f9 209->214 226 5b4bf11-5b4bf66 210->226 227 5b4be9c-5b4bf09 210->227 214->204 228 5b4c0ff-5b4c102 214->228 226->207 242 5b4bf68-5b4bf6a 226->242 227->226 228->204 229 5b4c108-5b4c10b 228->229 232 5b4c10d-5b4c111 229->232 233 5b4c129-5b4c13b 229->233 234 5b4c113-5b4c117 232->234 235 5b4c11f-5b4c123 232->235 240 5b4c13d-5b4c1a0 233->240 241 5b4c1a8-5b4c1b7 233->241 234->235 235->233 237 5b4c1c8-5b4c20f 235->237 240->241 241->204 241->214 242->207 245 5b4bf6c-5b4bf8b 242->245 245->173 254 5b4bf8d 245->254 254->207
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764464634.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b40000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: 4'^q$4'^q$4'^q$4'^q$4'^q
                                                                                                                                                              • API String ID: 0-4202989938
                                                                                                                                                              • Opcode ID: a8fe269e3a3e47d104f6dc133c843f9a09daeb9a00c35ac131cc199d96d45ab0
                                                                                                                                                              • Instruction ID: 8b384f48ff676d623cdeea91170e3deb8a0ae70a67d0ca992c00cf20d67ca191
                                                                                                                                                              • Opcode Fuzzy Hash: a8fe269e3a3e47d104f6dc133c843f9a09daeb9a00c35ac131cc199d96d45ab0
                                                                                                                                                              • Instruction Fuzzy Hash: F8426E70A006059FCB14DF69C894AAEFBF2FF88310F148569E519AB7A5DB30ED45CB90
                                                                                                                                                              Function 05B487B8 Relevance: 2.0, Strings: 1, Instructions: 701COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 511 5b487b8-5b48803 call 5b43690 657 5b48805 call 5b44e40 511->657 658 5b48805 call 5b49430 511->658 659 5b48805 call 5b487b8 511->659 660 5b48805 call 5b487a8 511->660 515 5b4880b-5b4886d call 5b4a0d1 666 5b4886f call 5b4f455 515->666 667 5b4886f call 5b4f53e 515->667 521 5b48875-5b488df 653 5b488e1 call 5b62c90 521->653 654 5b488e1 call 5b62c81 521->654 527 5b488e7-5b4892b 661 5b4892d call 5b62c90 527->661 662 5b4892d call 5b62c81 527->662 531 5b48933-5b489d4 538 5b49425-5b4943c 531->538 539 5b489da-5b48a0f 531->539 542 5b4943e-5b4946a 538->542 543 5b4946b-5b494c5 call 5b44e40 call 5b49b38 538->543 539->538 544 5b48a15-5b48a4a 539->544 542->543 560 5b494cb-5b49514 543->560 544->538 548 5b48a50-5b48a85 544->548 548->538 551 5b48a8b-5b48ac0 548->551 551->538 555 5b48ac6-5b48afb 551->555 555->538 559 5b48b01-5b48b1c 555->559 563 5b48b22-5b48b4e 559->563 564 5b48bab-5b48bbe 559->564 571 5b48b50-5b48b94 563->571 572 5b48b9c-5b48ba5 563->572 566 5b48bd7-5b48be6 564->566 567 5b48bc0-5b48bd5 564->567 568 5b48bec-5b48bf2 566->568 567->568 663 5b48bf4 call 5b6370f 568->663 664 5b48bf4 call 5b64958 568->664 571->572 572->563 572->564 573 5b48bfa-5b48c13 574 5b48c15-5b48c8c 573->574 575 5b48c8e-5b48cab 573->575 574->575 581 5b48cad-5b48cc2 574->581 577 5b48cc8-5b49013 575->577 626 5b491ad-5b491c9 577->626 627 5b49019-5b49191 577->627 581->577 629 5b491d7 626->629 630 5b491cb 626->630 655 5b49193 call 5b64c90 627->655 656 5b49193 call 5b64c50 627->656 629->538 630->629 651 5b49199-5b491a7 651->626 651->627 653->527 654->527 655->651 656->651 657->515 658->515 659->515 660->515 661->531 662->531 663->573 664->573 666->521 667->521
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764464634.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b40000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 0-3916222277
                                                                                                                                                              • Opcode ID: e1912353b013eb0c9444006921d0215a4b84a7de642e96edaf9f8df03e976e9d
                                                                                                                                                              • Instruction ID: ca4b46bc376282f703437441616f7c5be26c2c5a2b8d61fc003c545fda00c1ed
                                                                                                                                                              • Opcode Fuzzy Hash: e1912353b013eb0c9444006921d0215a4b84a7de642e96edaf9f8df03e976e9d
                                                                                                                                                              • Instruction Fuzzy Hash: 87624A34A00319CFCB15DF68D8586AEBBB6FF89300F108599E909A7394DB75AD85CF90
                                                                                                                                                              Function 05B487A8 Relevance: 1.9, Strings: 1, Instructions: 622COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 669 5b487a8-5b48803 call 5b43690 812 5b48805 call 5b44e40 669->812 813 5b48805 call 5b49430 669->813 814 5b48805 call 5b487b8 669->814 815 5b48805 call 5b487a8 669->815 674 5b4880b-5b4886d call 5b4a0d1 821 5b4886f call 5b4f455 674->821 822 5b4886f call 5b4f53e 674->822 680 5b48875-5b488df 824 5b488e1 call 5b62c90 680->824 825 5b488e1 call 5b62c81 680->825 686 5b488e7-5b4892b 816 5b4892d call 5b62c90 686->816 817 5b4892d call 5b62c81 686->817 690 5b48933-5b489d4 697 5b49425-5b4943c 690->697 698 5b489da-5b48a0f 690->698 701 5b4943e-5b4946a 697->701 702 5b4946b-5b494c5 call 5b44e40 call 5b49b38 697->702 698->697 703 5b48a15-5b48a4a 698->703 701->702 719 5b494cb-5b49514 702->719 703->697 707 5b48a50-5b48a85 703->707 707->697 710 5b48a8b-5b48ac0 707->710 710->697 714 5b48ac6-5b48afb 710->714 714->697 718 5b48b01-5b48b1c 714->718 722 5b48b22-5b48b4e 718->722 723 5b48bab-5b48bbe 718->723 730 5b48b50-5b48b94 722->730 731 5b48b9c-5b48ba5 722->731 725 5b48bd7-5b48be6 723->725 726 5b48bc0-5b48bd5 723->726 727 5b48bec-5b48bf2 725->727 726->727 818 5b48bf4 call 5b6370f 727->818 819 5b48bf4 call 5b64958 727->819 730->731 731->722 731->723 732 5b48bfa-5b48c13 733 5b48c15-5b48c8c 732->733 734 5b48c8e-5b48cab 732->734 733->734 740 5b48cad-5b48cc2 733->740 736 5b48cc8-5b49013 734->736 785 5b491ad-5b491c9 736->785 786 5b49019-5b49191 736->786 740->736 788 5b491d7 785->788 789 5b491cb 785->789 826 5b49193 call 5b64c90 786->826 827 5b49193 call 5b64c50 786->827 788->697 789->788 810 5b49199-5b491a7 810->785 810->786 812->674 813->674 814->674 815->674 816->690 817->690 818->732 819->732 821->680 822->680 824->686 825->686 826->810 827->810
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764464634.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b40000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 0-3916222277
                                                                                                                                                              • Opcode ID: 62c124cdd86c7d480f690f012132b63f520305f8505e755dce7fb02f0a747f17
                                                                                                                                                              • Instruction ID: b9e2b4e77fdc55e415b71d4759f0b45b9552f02e482376af8adf71bb27c2dfe9
                                                                                                                                                              • Opcode Fuzzy Hash: 62c124cdd86c7d480f690f012132b63f520305f8505e755dce7fb02f0a747f17
                                                                                                                                                              • Instruction Fuzzy Hash: BC424B34A00318DFCB159F28D948BADBBB6FF89300F148599E909A7394DB75AD85CF90
                                                                                                                                                              Function 05B60CB8 Relevance: 1.3, Instructions: 1277COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 4db6415884c6ae3be008150a23a0aa51bd7456ca52be478575aed3114aa96ff7
                                                                                                                                                              • Instruction ID: a965c389312ffaafbcf0e96d6e0a518d0056e71fcf062d2bf1d7e31291d78f85
                                                                                                                                                              • Opcode Fuzzy Hash: 4db6415884c6ae3be008150a23a0aa51bd7456ca52be478575aed3114aa96ff7
                                                                                                                                                              • Instruction Fuzzy Hash: 0AC21974A002089FDB14DF69C894AADBBB2FF88310F158199E959AB3A5DB34FD41CF50
                                                                                                                                                              Function 05B60848 Relevance: 9.0, Strings: 7, Instructions: 220COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 0 5b60848-5b60872 2 5b60874-5b6088e 0->2 3 5b60891-5b6089d 0->3 6 5b608c0-5b608cc 3->6 7 5b6089f-5b608bd 3->7 11 5b609d5-5b609e1 6->11 12 5b608d2-5b608d7 6->12 20 5b609e3-5b609e9 11->20 21 5b60a21-5b60a6c 11->21 13 5b608f5 12->13 14 5b608d9-5b608df 12->14 19 5b608f7-5b6090f 13->19 17 5b608e5-5b608f1 14->17 18 5b608e1-5b608e3 14->18 22 5b608f3 17->22 18->22 28 5b60915-5b6091e 19->28 29 5b609bf-5b609d2 19->29 23 5b609f7-5b60a1e 20->23 24 5b609eb-5b609ed 20->24 46 5b60a74-5b60a8c 21->46 47 5b60a6e 21->47 22->19 24->23 34 5b60920-5b60926 28->34 35 5b6093c 28->35 36 5b6092c-5b60938 34->36 37 5b60928-5b6092a 34->37 38 5b6093e-5b6097b call 5b60848 * 2 35->38 40 5b6093a 36->40 37->40 55 5b60981-5b6099a 38->55 40->38 62 5b60a8e call 5b60ab7 46->62 63 5b60a8e call 5b60ac8 46->63 48 5b60a70-5b60a72 47->48 49 5b60a99-5b60ab4 47->49 48->46 48->49 54 5b60a94-5b60a98 57 5b609b4-5b609b8 55->57 58 5b6099c-5b609a2 55->58 57->29 59 5b609a6-5b609b2 58->59 60 5b609a4 58->60 59->57 60->57 62->54 63->54
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q
                                                                                                                                                              • API String ID: 0-2464098231
                                                                                                                                                              • Opcode ID: 68bbb8e5ef5448f0df2d13861ff4880b9c0eec63e5f5fc71465b81ca605aa945
                                                                                                                                                              • Instruction ID: bdbd50e8a693ceeebe9e21d005215b6d5ba63803f738b18fcc494536c0c73fe9
                                                                                                                                                              • Opcode Fuzzy Hash: 68bbb8e5ef5448f0df2d13861ff4880b9c0eec63e5f5fc71465b81ca605aa945
                                                                                                                                                              • Instruction Fuzzy Hash: 64711A31B402198FDB29AF69985467EBBB3FFC9710B20846AD445DB344DF35AC01C791
                                                                                                                                                              Function 017B7A30 Relevance: 3.9, Strings: 3, Instructions: 187COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 260 17b7a30-17b7a7f 265 17b7abd-17b7ad5 260->265 266 17b7a81-17b7a95 260->266 269 17b7b13-17b7b2b 265->269 270 17b7ad7-17b7aeb 265->270 271 17b7a9e-17b7abb 266->271 272 17b7a97 266->272 276 17b7b69-17b7b8e 269->276 277 17b7b2d-17b7b41 269->277 278 17b7aed 270->278 279 17b7af4-17b7b11 270->279 271->265 272->271 288 17b7bcc-17b7c05 276->288 289 17b7b90-17b7ba4 276->289 284 17b7b4a-17b7b67 277->284 285 17b7b43 277->285 278->279 279->269 284->276 285->284 301 17b7c43-17b7c7c 288->301 302 17b7c07-17b7c1b 288->302 294 17b7bad-17b7bca 289->294 295 17b7ba6 289->295 294->288 295->294 312 17b7cba-17b7cc9 301->312 313 17b7c7e-17b7c92 301->313 305 17b7c1d 302->305 306 17b7c24-17b7c41 302->306 305->306 306->301 316 17b7c9b-17b7cb8 313->316 317 17b7c94 313->317 316->312 317->316
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: #!$K6$7
                                                                                                                                                              • API String ID: 0-185628103
                                                                                                                                                              • Opcode ID: 0e2c5d4a9101cba872a316ff80434bcd08127658e10d0f9cefda2cce6a2042ec
                                                                                                                                                              • Instruction ID: c5b1c167624119650d0ca988f01d3f0f9c8a2deee3d730893e510eac3a48f406
                                                                                                                                                              • Opcode Fuzzy Hash: 0e2c5d4a9101cba872a316ff80434bcd08127658e10d0f9cefda2cce6a2042ec
                                                                                                                                                              • Instruction Fuzzy Hash: 296183313103015FC715AB7DA89875EFBABEBC42503509669E41ACB3D8EF74EC458B80
                                                                                                                                                              Function 05B62C90 Relevance: 2.8, Strings: 2, Instructions: 348COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 320 5b62c90-5b62cf8 324 5b62d61-5b62d67 320->324 325 5b62cfa 320->325 407 5b62d6a call 5b62c90 324->407 408 5b62d6a call 5b62c81 324->408 326 5b62cfd-5b62d03 325->326 328 5b62d89-5b62de8 326->328 329 5b62d09-5b62d13 326->329 327 5b62d70-5b62d86 call 5b62820 342 5b62e1a-5b62e1f call 5b4ff60 328->342 343 5b62dea-5b62df9 328->343 329->328 331 5b62d15-5b62d1c call 5b60848 329->331 335 5b62d21-5b62d5f 331->335 335->324 335->326 345 5b62e25-5b62e47 342->345 346 5b62ed6-5b62ee0 343->346 347 5b62dff-5b62e0a 343->347 351 5b62e4d 345->351 352 5b62ec9-5b62ed3 345->352 353 5b62ee2 346->353 354 5b62ee3-5b62eff 346->354 347->346 348 5b62e10-5b62e18 347->348 348->342 348->343 355 5b62e50-5b62e66 351->355 353->354 356 5b62f05-5b62f07 354->356 357 5b62fb0-5b62fd5 354->357 361 5b62e6f 355->361 362 5b62e68-5b62e6d 355->362 358 5b62fdc-5b62fe0 356->358 359 5b62f0d-5b62f11 356->359 357->358 365 5b62fe2-5b62fe8 358->365 366 5b62fea 358->366 359->358 363 5b62f17-5b62f1f 359->363 368 5b62e74-5b62e7a 361->368 362->368 369 5b62f25-5b62f27 363->369 370 5b63023-5b6307b 363->370 367 5b62ff0-5b6301c 365->367 366->367 367->370 371 5b62eb2-5b62ec7 368->371 372 5b62e7c 368->372 373 5b62f37-5b62f3b 369->373 374 5b62f29-5b62f31 369->374 402 5b63083 370->402 403 5b6307d 370->403 371->352 371->355 377 5b62e7f-5b62e85 372->377 378 5b62f3d-5b62f41 373->378 379 5b62fa9-5b62fad 373->379 374->370 374->373 377->346 381 5b62e87-5b62eb0 377->381 382 5b62f43-5b62f57 378->382 383 5b62f59-5b62f6d 378->383 381->371 381->377 382->383 392 5b62f76-5b62f78 382->392 383->392 393 5b62f6f-5b62f73 383->393 394 5b62f91-5b62fa1 392->394 395 5b62f7a-5b62f8e 392->395 404 5b62fa3 call 5b63198 394->404 405 5b62fa3 call 5b63189 394->405 403->402 404->379 405->379 407->327 408->327
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: (bq$Hbq
                                                                                                                                                              • API String ID: 0-4081012451
                                                                                                                                                              • Opcode ID: 5c06d055a228f265f5b67ea7d2c6f3975e7d7992a19896624cf2acef0f4202b6
                                                                                                                                                              • Instruction ID: 4680a9cb25786884bf4a44ff931743befedd8b6cfa8d73533b3e218cbb3c4cc3
                                                                                                                                                              • Opcode Fuzzy Hash: 5c06d055a228f265f5b67ea7d2c6f3975e7d7992a19896624cf2acef0f4202b6
                                                                                                                                                              • Instruction Fuzzy Hash: B8D17135A002199FDB05DFA9C984AAEFBB6FF88310F158065E815AB354DB34ED41CBA1
                                                                                                                                                              Function 017BD531 Relevance: 2.6, Strings: 2, Instructions: 116COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 409 17bd531-17bd538 410 17bd53a-17bd558 409->410 411 17bd588-17bd58c 409->411 414 17bd55e-17bd560 410->414 415 17bd635-17bd65a 410->415 412 17bd58e-17bd596 411->412 413 17bd5b1-17bd5c5 411->413 416 17bd598-17bd59a 412->416 417 17bd5a4 412->417 427 17bd5d1-17bd5e2 413->427 428 17bd5c7-17bd5ce 413->428 418 17bd661-17bd665 414->418 419 17bd566-17bd56a 414->419 415->418 416->417 454 17bd5a6 call 17bd531 417->454 455 17bd5a6 call 17bd6f0 417->455 456 17bd5a6 call 17bd6e0 417->456 457 17bd5a6 call 17bd505 417->457 420 17bd66f 418->420 421 17bd667-17bd66d 418->421 419->418 423 17bd570-17bd578 419->423 425 17bd675-17bd6a1 420->425 421->425 432 17bd6a8-17bd6f4 423->432 433 17bd57e-17bd582 423->433 425->432 426 17bd5ac-17bd5af 426->413 426->427 430 17bd5f2 427->430 431 17bd5e4-17bd5f0 427->431 436 17bd5f4-17bd603 430->436 431->436 453 17bd6fc-17bd701 432->453 433->411 435 17bd62b-17bd632 433->435 435->432 444 17bd613 436->444 445 17bd605-17bd611 436->445 446 17bd616-17bd628 444->446 445->446 458 17bd629 call 17bdad8 446->458 459 17bd629 call 17bdac8 446->459 454->426 455->426 456->426 457->426 458->435 459->435
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: (bq$Hbq
                                                                                                                                                              • API String ID: 0-4081012451
                                                                                                                                                              • Opcode ID: 6712205e21abaaf3133c6daaa0d4983479bcea6b5241da0b1ecc84d25b597cd9
                                                                                                                                                              • Instruction ID: 844ca916bdba1a32a051c6910d8f30399fbd82904f5b89e42a7e34073d87fa16
                                                                                                                                                              • Opcode Fuzzy Hash: 6712205e21abaaf3133c6daaa0d4983479bcea6b5241da0b1ecc84d25b597cd9
                                                                                                                                                              • Instruction Fuzzy Hash: 2931F5307002958BCB55AEBDC4987AEBBE2FF80388F244569E909CB384DF34DC018791
                                                                                                                                                              Function 05B64C90 Relevance: 2.6, Strings: 2, Instructions: 105COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 460 5b64c90-5b64c9b 462 5b64c9d-5b64ca0 460->462 463 5b64cc8-5b64cf3 460->463 464 5b64ca2-5b64caa 462->464 465 5b64cfa-5b64d25 462->465 463->465 467 5b64cb0-5b64cc7 464->467 468 5b64d2c-5b64dc2 call 5b651d8 call 5b66470 call 5b62820 464->468 465->468 491 5b64dc7-5b64dcb 468->491
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: Te^q$Te^q
                                                                                                                                                              • API String ID: 0-3743469327
                                                                                                                                                              • Opcode ID: 0696a95948e89330623933bf6835056b7351923543d5be3e43e4fdfde9618629
                                                                                                                                                              • Instruction ID: 423d185a7104b05a50e1ca0c627a59ef87f46bd28f17e0fe40f928f40ee54007
                                                                                                                                                              • Opcode Fuzzy Hash: 0696a95948e89330623933bf6835056b7351923543d5be3e43e4fdfde9618629
                                                                                                                                                              • Instruction Fuzzy Hash: 003134317042544FCB45BF7D84A882EBBE6AFD279032585AAD00DCF3A6CE35EC068795
                                                                                                                                                              Function 05B68935 Relevance: 2.2, Strings: 1, Instructions: 994COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 494 5b68935-5b68d6c call 5b68914 call 5b68e10 502 5b68d72-5b68db0 494->502 507 5b68db2 502->507 508 5b68dbb 502->508 507->508 509 5b68dbc 508->509 509->509
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: Te^q
                                                                                                                                                              • API String ID: 0-671973202
                                                                                                                                                              • Opcode ID: 55f8f5bc4007e845f04dd1a744d53ddae558d28af462413a5c4fd46f5c2fcafd
                                                                                                                                                              • Instruction ID: 1decf086ada71c0fad6f26441fb4355c3c7316703d6d60dc98b66c298ea26457
                                                                                                                                                              • Opcode Fuzzy Hash: 55f8f5bc4007e845f04dd1a744d53ddae558d28af462413a5c4fd46f5c2fcafd
                                                                                                                                                              • Instruction Fuzzy Hash: C6219031709244DFCB199F28C469A997BF2BF5A310B1500EAE442EB3A1DB35AC01CBA1
                                                                                                                                                              Function 05B651D8 Relevance: 1.5, Strings: 1, Instructions: 294COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 828 5b651d8-5b6521f 831 5b65225-5b65267 828->831 832 5b654f8-5b6551c 828->832 841 5b6529d-5b652be 831->841 842 5b65269-5b6526c 831->842 840 5b65523-5b65586 832->840 848 5b652c4-5b652cd 841->848 849 5b65371-5b6537b 841->849 843 5b6526f-5b65278 842->843 843->840 847 5b6527e-5b6529b 843->847 847->841 847->843 848->840 850 5b652d3-5b652f9 848->850 852 5b654f0-5b654f7 849->852 853 5b65381-5b6538a 849->853 865 5b65308-5b65315 850->865 853->840 855 5b65390-5b653b9 853->855 855->840 864 5b653bf-5b653e3 855->864 864->840 868 5b653e9-5b653f5 864->868 872 5b65317-5b65320 865->872 873 5b652fb-5b65302 865->873 870 5b654e0-5b654ea 868->870 871 5b653fb-5b65405 868->871 870->852 870->853 871->840 874 5b6540b-5b65427 871->874 872->840 875 5b65326-5b65343 872->875 873->865 874->840 879 5b6542d-5b65439 874->879 875->840 878 5b65349-5b6536b 875->878 878->848 878->849 879->840 880 5b6543f-5b65450 879->880 880->840 882 5b65456-5b65461 880->882 884 5b6546b-5b6547b 882->884 884->840 886 5b65481-5b6548d 884->886 886->840 887 5b65493-5b654a8 886->887 887->840 888 5b654aa-5b654cb 887->888 888->840 890 5b654cd-5b654da 888->890 890->870 890->871
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: Te^q
                                                                                                                                                              • API String ID: 0-671973202
                                                                                                                                                              • Opcode ID: ffa0e5243af585c2e649e3479378469017053dacf3f9bbc98dbf3c3d33c7b415
                                                                                                                                                              • Instruction ID: 9837484832589b2062a7f8c483c0bca5a0ef4ebde02a0d164bfd1738a8c58480
                                                                                                                                                              • Opcode Fuzzy Hash: ffa0e5243af585c2e649e3479378469017053dacf3f9bbc98dbf3c3d33c7b415
                                                                                                                                                              • Instruction Fuzzy Hash: 82C16A3460021ACFCB14DF58C488DAEBBF6FF84304B968495E44A9B2A6DB34FD55CB90
                                                                                                                                                              Function 017B8A98 Relevance: 1.4, Strings: 1, Instructions: 192COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 995 17b8a98-17b8ab8 996 17b8aba-17b8adb 995->996 997 17b8ae2-17b8af1 995->997 996->997 998 17b8afd-17b8b0a 997->998 999 17b8af3 997->999 1002 17b8bde-17b8bf2 998->1002 1003 17b8b10-17b8b1f 998->1003 999->998 1007 17b8bfe-17b8c21 1002->1007 1008 17b8bf4 1002->1008 1005 17b8b2b-17b8b37 1003->1005 1006 17b8b21 1003->1006 1012 17b8b39-17b8b48 1005->1012 1013 17b8b70-17b8b7f 1005->1013 1006->1005 1019 17b8c2d-17b8c37 1007->1019 1020 17b8c23 1007->1020 1008->1007 1017 17b8b4a 1012->1017 1018 17b8b54-17b8b6f 1012->1018 1014 17b8b8b-17b8bb2 1013->1014 1015 17b8b81 1013->1015 1026 17b8bbe-17b8bdd 1014->1026 1027 17b8bb4 1014->1027 1015->1014 1017->1018 1051 17b8c3a call 17b8da8 1019->1051 1052 17b8c3a call 17b8da1 1019->1052 1020->1019 1027->1026 1028 17b8c40-17b8c42 1029 17b8c88-17b8ca1 1028->1029 1030 17b8c44-17b8c53 1028->1030 1035 17b8cac-17b8ccd 1029->1035 1036 17b8ca3 1029->1036 1033 17b8c5f-17b8c86 1030->1033 1034 17b8c55 1030->1034 1033->1029 1033->1030 1034->1033 1042 17b8c7f-17b8c86 1035->1042 1043 17b8ccf-17b8cfe 1035->1043 1036->1035 1042->1029 1042->1030 1045 17b8d0f 1043->1045 1046 17b8d00-17b8d0d 1043->1046 1047 17b8d12-17b8d2e 1045->1047 1046->1047 1051->1028 1052->1028
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: (bq
                                                                                                                                                              • API String ID: 0-149360118
                                                                                                                                                              • Opcode ID: 020af925f3883563686c590139e3b01eaeeb526c2bfd07de25fd3cee155f923b
                                                                                                                                                              • Instruction ID: 8f27eacefe2f7ebbb18bec5f2ea786b4aa5f13ef0c94a8c33a3ee28145c5a24f
                                                                                                                                                              • Opcode Fuzzy Hash: 020af925f3883563686c590139e3b01eaeeb526c2bfd07de25fd3cee155f923b
                                                                                                                                                              • Instruction Fuzzy Hash: 45610774B106098FCB14DF69D994AAEB7B6FF8D314B1081A5F906AB365DB30EC01CB81
                                                                                                                                                              Function 05B68E10 Relevance: 1.4, Strings: 1, Instructions: 131COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 1053 5b68e10-5b68e30 1054 5b68e36-5b68e42 1053->1054 1055 5b68f62-5b68f88 1053->1055 1058 5b68f8f-5b68fd7 1054->1058 1059 5b68e48-5b68e96 1054->1059 1055->1058 1074 5b68f03-5b68f09 1059->1074 1075 5b68f0b-5b68f61 1074->1075 1076 5b68e98-5b68ea6 1074->1076 1079 5b68ea8-5b68ee6 1076->1079 1080 5b68ee9 1076->1080 1079->1080 1089 5b68eeb call 5b4c6e8 1080->1089 1090 5b68eeb call 5b4c6d8 1080->1090 1091 5b68eeb call 5b4c978 1080->1091 1084 5b68ef0-5b68efc 1085 5b68f02 1084->1085 1085->1074 1089->1084 1090->1084 1091->1084
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: 4'^q
                                                                                                                                                              • API String ID: 0-1614139903
                                                                                                                                                              • Opcode ID: 7995f52a5db129441c32184983c5d3f9613e4c313ad5bab1da2ef81a81e21634
                                                                                                                                                              • Instruction ID: 4e29e1f72665e119dc44e1707538d5b5320fdfd128842ec0cc9c802c5c6110f0
                                                                                                                                                              • Opcode Fuzzy Hash: 7995f52a5db129441c32184983c5d3f9613e4c313ad5bab1da2ef81a81e21634
                                                                                                                                                              • Instruction Fuzzy Hash: D6416F30B002059FC754DF79C494AAEBBF2FF88710F6485A8E509AB7A0DF31AD418B90
                                                                                                                                                              Function 017BD505 Relevance: 1.4, Strings: 1, Instructions: 117COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: Hbq
                                                                                                                                                              • API String ID: 0-1245868
                                                                                                                                                              • Opcode ID: 13956e93cd2bb8d3a4fbb6f698d7ef1c8a7f589bb0e3f4a32d5dae28b843ece9
                                                                                                                                                              • Instruction ID: c58a9d348db424d8fb93ead31ffcb39ede8719b71bca548e96d7ef9f61216ac2
                                                                                                                                                              • Opcode Fuzzy Hash: 13956e93cd2bb8d3a4fbb6f698d7ef1c8a7f589bb0e3f4a32d5dae28b843ece9
                                                                                                                                                              • Instruction Fuzzy Hash: 7F41E035B042458BCF25DFA8C4D46AEFBB2FF85358F2484AAE909CB399DB34D8018750
                                                                                                                                                              Function 017BB9B0 Relevance: 1.4, Strings: 1, Instructions: 100COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: {O0q^
                                                                                                                                                              • API String ID: 0-2622660391
                                                                                                                                                              • Opcode ID: 3a2a6e39d63b7bac0d2f14bb8eeed45bd87101ae0ea0fc146cadd83569ea2d1d
                                                                                                                                                              • Instruction ID: d9082cb0d36cf05d2fc0513775c6273306b8be1036e0cdf7bd651c55389d4169
                                                                                                                                                              • Opcode Fuzzy Hash: 3a2a6e39d63b7bac0d2f14bb8eeed45bd87101ae0ea0fc146cadd83569ea2d1d
                                                                                                                                                              • Instruction Fuzzy Hash: CD31E4223043511FC712B73DA8A86AEFBA6EFC521074445A9D0198B3A9EF70EC4587D1
                                                                                                                                                              Function 017BB9E8 Relevance: 1.3, Strings: 1, Instructions: 80COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: {O0q^
                                                                                                                                                              • API String ID: 0-2622660391
                                                                                                                                                              • Opcode ID: 05348178102cd27955b6e11d30f2c9093e6a333093ab66567631909affbd9bb5
                                                                                                                                                              • Instruction ID: 3165b551b42079ccddf9f134efcacaf03a2ca44d71359f9a5c4fb98da128c5c5
                                                                                                                                                              • Opcode Fuzzy Hash: 05348178102cd27955b6e11d30f2c9093e6a333093ab66567631909affbd9bb5
                                                                                                                                                              • Instruction Fuzzy Hash: 5E21B3313103025B8715B67DA9D876EFA9BEBD47503408568D42ACB398EF74EC4587D0
                                                                                                                                                              Function 05B64180 Relevance: 1.3, Strings: 1, Instructions: 78COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: LR^q
                                                                                                                                                              • API String ID: 0-2625958711
                                                                                                                                                              • Opcode ID: bf161ef33c50e9f06af873b9df496fb6fdfbdc258243fcb786c918afb3811a5d
                                                                                                                                                              • Instruction ID: d341cca08cb6d75e21762d49eeb0dddcb80a7a7c89e6e60891759948d86f75e6
                                                                                                                                                              • Opcode Fuzzy Hash: bf161ef33c50e9f06af873b9df496fb6fdfbdc258243fcb786c918afb3811a5d
                                                                                                                                                              • Instruction Fuzzy Hash: 15214F30B102099BDF18DFA5E5986AE7BB7EBC8B10F208069E406A7394DF746D01CB95
                                                                                                                                                              Function 05B64171 Relevance: 1.3, Strings: 1, Instructions: 76COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: LR^q
                                                                                                                                                              • API String ID: 0-2625958711
                                                                                                                                                              • Opcode ID: 6a5f96751f3e718fb20b7530f8878ca7e6b0f63b7424f9ce27ca660e4359a94c
                                                                                                                                                              • Instruction ID: 2e5c237da216d6c5082b481d95d0dd1af3be7bd356df2257e833e6b2affefbfd
                                                                                                                                                              • Opcode Fuzzy Hash: 6a5f96751f3e718fb20b7530f8878ca7e6b0f63b7424f9ce27ca660e4359a94c
                                                                                                                                                              • Instruction Fuzzy Hash: 6D215E30B102099BDF18DFA5E5A97AE7BB7EB88B10F248069E402A7394DB746D05CB51
                                                                                                                                                              Function 017BD078 Relevance: 1.3, Strings: 1, Instructions: 65COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: (bq
                                                                                                                                                              • API String ID: 0-149360118
                                                                                                                                                              • Opcode ID: e4562a799956ae9296014e5a22f6b27f780f559b714f3b9aa8217ae674bf3977
                                                                                                                                                              • Instruction ID: ec0ff2754d51de4da3adac79eefd63feb9ba732fc8e07e558e4b1f74bd93c10e
                                                                                                                                                              • Opcode Fuzzy Hash: e4562a799956ae9296014e5a22f6b27f780f559b714f3b9aa8217ae674bf3977
                                                                                                                                                              • Instruction Fuzzy Hash: 7511D07A3002058FCB25CB6CD994B6ABBE2FFC9354725816AE85ADB355DB31EC018B50
                                                                                                                                                              Function 017BD088 Relevance: 1.3, Strings: 1, Instructions: 61COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: (bq
                                                                                                                                                              • API String ID: 0-149360118
                                                                                                                                                              • Opcode ID: 316a4f2561a442fe6dfb74b22dd9668af392e32e8aba0b967d9888aa81c01ef8
                                                                                                                                                              • Instruction ID: 5f0d4383629c030ea9064e680c4b4f0fe7f9ca3bec1853728ab06b1f51b95257
                                                                                                                                                              • Opcode Fuzzy Hash: 316a4f2561a442fe6dfb74b22dd9668af392e32e8aba0b967d9888aa81c01ef8
                                                                                                                                                              • Instruction Fuzzy Hash: A9118F793002058FCB25DB5DD894B6AB7E7FBC83647158469E85AC7354DF32EC018B50
                                                                                                                                                              Function 05B6A011 Relevance: 1.3, Strings: 1, Instructions: 53COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: Te^q
                                                                                                                                                              • API String ID: 0-671973202
                                                                                                                                                              • Opcode ID: 3522e55c2c512322e8b3afef593f02e35a51f2f4820e568cbd1f3d64b53a3d20
                                                                                                                                                              • Instruction ID: 08ccbdd94ae892b2049b29ec19612e66be73cb78480ce478a819faf297a0a7c8
                                                                                                                                                              • Opcode Fuzzy Hash: 3522e55c2c512322e8b3afef593f02e35a51f2f4820e568cbd1f3d64b53a3d20
                                                                                                                                                              • Instruction Fuzzy Hash: A20126727082905FC715973D9828B9ABFF59F8AA10B1A40EBF145CB3A2C9609C058BA5
                                                                                                                                                              Function 05B68D28 Relevance: 1.3, Strings: 1, Instructions: 49COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: Te^q
                                                                                                                                                              • API String ID: 0-671973202
                                                                                                                                                              • Opcode ID: 916d883be35b98fe538237ef220890c65c31959bfa4e8f01661e0ee284264bd7
                                                                                                                                                              • Instruction ID: b9252cb0943ad8edcd3443f735ca46623f2bdf2c7c073eee51d862508c83d3ae
                                                                                                                                                              • Opcode Fuzzy Hash: 916d883be35b98fe538237ef220890c65c31959bfa4e8f01661e0ee284264bd7
                                                                                                                                                              • Instruction Fuzzy Hash: F111FA74B442159FCB58DF68C459AADB7F6BF89710F2004A9E406EB3A0CF75AC41CBA1
                                                                                                                                                              Function 017BFB12 Relevance: 1.3, Strings: 1, Instructions: 40COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: Te^q
                                                                                                                                                              • API String ID: 0-671973202
                                                                                                                                                              • Opcode ID: 5e52d9c0797fb0a06182ee7eb3db147fb5ea6023e428e05e21981ffc87a746f0
                                                                                                                                                              • Instruction ID: c988407818202f378278af67c51a7437c48f12da13ff21eda73daed94d137c6e
                                                                                                                                                              • Opcode Fuzzy Hash: 5e52d9c0797fb0a06182ee7eb3db147fb5ea6023e428e05e21981ffc87a746f0
                                                                                                                                                              • Instruction Fuzzy Hash: 4AF0F6313042005FC315969998949ABFBEBEFC9260714846BE909CB3A5C931DC0687A0
                                                                                                                                                              Function 05B68090 Relevance: 1.3, Strings: 1, Instructions: 33COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: Te^q
                                                                                                                                                              • API String ID: 0-671973202
                                                                                                                                                              • Opcode ID: cbad9582491e60f9cc248776bb0a1dde000f144b43e3dc8e695627217d2a9066
                                                                                                                                                              • Instruction ID: ba6a1caa81c6b48ef2e2e954174d0415aa78ab6ebcd2a1e5d85431800d4e9d5b
                                                                                                                                                              • Opcode Fuzzy Hash: cbad9582491e60f9cc248776bb0a1dde000f144b43e3dc8e695627217d2a9066
                                                                                                                                                              • Instruction Fuzzy Hash: 47F02B313011115FC714662E985CAAEFBDAEFDD620B1440B9F10ECB351CD308C025BD4
                                                                                                                                                              Function 05B6A020 Relevance: 1.3, Strings: 1, Instructions: 31COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: Te^q
                                                                                                                                                              • API String ID: 0-671973202
                                                                                                                                                              • Opcode ID: 6b875835d84018393555a1c7b60b4ac2f83ca007aab3df363869ff27e6864474
                                                                                                                                                              • Instruction ID: d08ca35ebedf68c0a93a156e68d291ad231fe8f17ff83d020310ae3b775db0c4
                                                                                                                                                              • Opcode Fuzzy Hash: 6b875835d84018393555a1c7b60b4ac2f83ca007aab3df363869ff27e6864474
                                                                                                                                                              • Instruction Fuzzy Hash: FFE065357501105FC7549B5EE858E5AB7DAEFCDB20F254069F109CB361CE61EC018B94
                                                                                                                                                              Function 017BBF91 Relevance: 1.3, Strings: 1, Instructions: 16COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: PH^q
                                                                                                                                                              • API String ID: 0-2549759414
                                                                                                                                                              • Opcode ID: db1d8df33d855913fedd107fe584286788721730e5a5ad52be8f06923391c40b
                                                                                                                                                              • Instruction ID: b9e0979b87bc0a497e489094fb586a81ac6d2f631299667fb10d830fe56bd632
                                                                                                                                                              • Opcode Fuzzy Hash: db1d8df33d855913fedd107fe584286788721730e5a5ad52be8f06923391c40b
                                                                                                                                                              • Instruction Fuzzy Hash: 81D02B7250434447CF144F34A9083153F55BB42214F64055894528B2C1E633D4038690
                                                                                                                                                              Function 05B66470 Relevance: .3, Instructions: 345COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 1ff69aea77105010e670d45f23d109f5deba09e4d1e58fa126281dbc96cbde5c
                                                                                                                                                              • Instruction ID: 565294b1e0e52599ca7b44eb1a9f1faf31b344decb3d3808c63a6b4141b0c2ae
                                                                                                                                                              • Opcode Fuzzy Hash: 1ff69aea77105010e670d45f23d109f5deba09e4d1e58fa126281dbc96cbde5c
                                                                                                                                                              • Instruction Fuzzy Hash: 90E15E74A00615CFCB04DF68C584AAAFBF6FF88300B5585A9E949AB365DB34FD41CB90
                                                                                                                                                              Function 05B66DC0 Relevance: .3, Instructions: 332COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 8a8114dd61d08a396009f03ac2292aec6662d0978887c16498c7bbfbd0c9647a
                                                                                                                                                              • Instruction ID: 0d8abfd5574f28d72f29b31f0ef09f4ff032e17b49eb160a730d77c8776368cf
                                                                                                                                                              • Opcode Fuzzy Hash: 8a8114dd61d08a396009f03ac2292aec6662d0978887c16498c7bbfbd0c9647a
                                                                                                                                                              • Instruction Fuzzy Hash: 4FC1CF30B006059FCB14DF69C880A6EBBF2FF84310F14C5AAE5599B295EB74ED45CB91
                                                                                                                                                              Function 017BDC59 Relevance: .3, Instructions: 301COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 213cffa548061780a8f1b061cb4e37f085177f07028a6fa4e5e0687f8b911a7b
                                                                                                                                                              • Instruction ID: 9f77e7b8df4089ca351deab0380224225922170c39e95f7465edd2672ee24d14
                                                                                                                                                              • Opcode Fuzzy Hash: 213cffa548061780a8f1b061cb4e37f085177f07028a6fa4e5e0687f8b911a7b
                                                                                                                                                              • Instruction Fuzzy Hash: 20C11735A0020ADFCF11CF98C9849AEBBB2FF49314B24849AF915A7365D731ED55CBA0
                                                                                                                                                              Function 05B61531 Relevance: .3, Instructions: 296COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: dbf3bc46a6b005a5ba7a6f905b63bd9da2a585391caecba5b1748338fc76721a
                                                                                                                                                              • Instruction ID: 9a3f97f621f09a6a3853e09bd3593963c81d5150d723083b67781a4f1e50784b
                                                                                                                                                              • Opcode Fuzzy Hash: dbf3bc46a6b005a5ba7a6f905b63bd9da2a585391caecba5b1748338fc76721a
                                                                                                                                                              • Instruction Fuzzy Hash: 85C1B078A002059FDB14DF58C894E6AB7F2FF88310F558199E919AB3A1DB34EC41CF60
                                                                                                                                                              Function 017B41E0 Relevance: .2, Instructions: 249COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: f60773d58e0c393ba25a70e76772f43970a3ed65ae30b0127ecd6643b043bf99
                                                                                                                                                              • Instruction ID: 1f5d6d97198d386444c369f6637d9957a11ba0c29ea280906659dbe00b1da312
                                                                                                                                                              • Opcode Fuzzy Hash: f60773d58e0c393ba25a70e76772f43970a3ed65ae30b0127ecd6643b043bf99
                                                                                                                                                              • Instruction Fuzzy Hash: 69A14E34B003059FCB05DB69D998A6EFBE6FB88340B148529E91ADB365DF74EC05CB40
                                                                                                                                                              Function 017B41F0 Relevance: .2, Instructions: 247COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 56a1fe381a0fc35a7daf34f3adcb491919f79bb9d15b0dcc23a6ad482d8150a4
                                                                                                                                                              • Instruction ID: bcf6f679668373aa985e97ae678e36781b1e884cb16d235e71e819b79f27a1bd
                                                                                                                                                              • Opcode Fuzzy Hash: 56a1fe381a0fc35a7daf34f3adcb491919f79bb9d15b0dcc23a6ad482d8150a4
                                                                                                                                                              • Instruction Fuzzy Hash: DF913D34B003059FCB15DB69D998A6EFBE6FB88340B148529E91ADB365DF74EC06CB40
                                                                                                                                                              Function 017B5EE0 Relevance: .2, Instructions: 220COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 4800f0d1505e84bf03d6fc5a9258b99f536c70d72c7acaa2c7e947d334942109
                                                                                                                                                              • Instruction ID: aa912af2ff3efca532f25577804f6828a330d35034f60cea6863cb5de5c75ca3
                                                                                                                                                              • Opcode Fuzzy Hash: 4800f0d1505e84bf03d6fc5a9258b99f536c70d72c7acaa2c7e947d334942109
                                                                                                                                                              • Instruction Fuzzy Hash: 15913B30B003098FCB15DF69D98869EFBF6EF85310B148669E9199B359DB70ED46CB80
                                                                                                                                                              Function 05B61C28 Relevance: .2, Instructions: 209COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: da7fd4f3ef8a0f95a25cdfcaf8abd854cb0fc0b13bda6ffe68df50f58e39329d
                                                                                                                                                              • Instruction ID: 14bebc353922eb9586c835e215c7425e6212432750ada07b4799370732b38aff
                                                                                                                                                              • Opcode Fuzzy Hash: da7fd4f3ef8a0f95a25cdfcaf8abd854cb0fc0b13bda6ffe68df50f58e39329d
                                                                                                                                                              • Instruction Fuzzy Hash: 5C817D74B006099FCB14DF69C885AAEBBB6FF84310F158199E509AB3A1DB30FD41CB90
                                                                                                                                                              Function 05B618B1 Relevance: .2, Instructions: 202COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 0f8c009e3eed0f26e1033493fcdfd1f9ccb5e0ef59c94b5cae7831fdd7ea0c0f
                                                                                                                                                              • Instruction ID: f09c47e82299b97e6cda0e7b1d5c0b2e4eb7245285185f625691b74f3c2c1077
                                                                                                                                                              • Opcode Fuzzy Hash: 0f8c009e3eed0f26e1033493fcdfd1f9ccb5e0ef59c94b5cae7831fdd7ea0c0f
                                                                                                                                                              • Instruction Fuzzy Hash: 90812875600704AFCB24DF68C980A6EBBB6FF84300B4589A9E8869F655D774FD41CFA0
                                                                                                                                                              Function 05B60AC8 Relevance: .2, Instructions: 196COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 9872694cca0da3ddb1586c63036acc08de5ec6aef5776df7d7e11432f69bae8c
                                                                                                                                                              • Instruction ID: 815bd5c6a11774f65d4866fa0514d3b3f91e166021add46c35a80b23e87b9963
                                                                                                                                                              • Opcode Fuzzy Hash: 9872694cca0da3ddb1586c63036acc08de5ec6aef5776df7d7e11432f69bae8c
                                                                                                                                                              • Instruction Fuzzy Hash: 1761A531B001199FCB18DF69C8989AEBBF2FF88310F148169E919E7355DB35AD11CB91
                                                                                                                                                              Function 017B6E68 Relevance: .2, Instructions: 193COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: f520f07e87022cf4b4dcd1dd33dbeb0e7e0676b2c6d6f5710956cc3611975b82
                                                                                                                                                              • Instruction ID: 21aca34de83b10006f9cb51d45733fa021d9b89d36467a58e4ec8ec3177a0451
                                                                                                                                                              • Opcode Fuzzy Hash: f520f07e87022cf4b4dcd1dd33dbeb0e7e0676b2c6d6f5710956cc3611975b82
                                                                                                                                                              • Instruction Fuzzy Hash: 08616C31B002098FCB45DF68D8945AEFBF2FF99210754866AE50ADB3A5DB71EC068B50
                                                                                                                                                              Function 017B64B9 Relevance: .2, Instructions: 155COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: f50630a766341d9175f15457a95db851b5e1d0d5cd1d38979d77778113ec9c90
                                                                                                                                                              • Instruction ID: 065f818ddf31c710d8e822df2d7b5d8eb6748773ec6186741fd8a3c1c679b791
                                                                                                                                                              • Opcode Fuzzy Hash: f50630a766341d9175f15457a95db851b5e1d0d5cd1d38979d77778113ec9c90
                                                                                                                                                              • Instruction Fuzzy Hash: 63513D35A10619CFCB45CFA9C88499DBBF6FF8A700B2581AAE505EF321DB71AD05CB40
                                                                                                                                                              Function 05B61C18 Relevance: .1, Instructions: 138COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 1892a76bf783c45ed16bbc999f67f725c6388f54e4d87cb20b12e95420a7d516
                                                                                                                                                              • Instruction ID: 34c32333d6d9320cf1aa31e85028c4d4e5908f29c4992aa0a751b6f54c04bd6c
                                                                                                                                                              • Opcode Fuzzy Hash: 1892a76bf783c45ed16bbc999f67f725c6388f54e4d87cb20b12e95420a7d516
                                                                                                                                                              • Instruction Fuzzy Hash: A35136747006059FCB04DF59C895E6EBBB6EF84310F558099E605AF3A1DB31EC41CB90
                                                                                                                                                              Function 017B61F0 Relevance: .1, Instructions: 137COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 9584f9400d97504491f7dbfb5da030219c388c3d9ace9a01c1b9e575a6aa7f41
                                                                                                                                                              • Instruction ID: 145f7310d84669df6bf95e01b0887a3eeefb2bbf7a7d87e31e6772096edfb528
                                                                                                                                                              • Opcode Fuzzy Hash: 9584f9400d97504491f7dbfb5da030219c388c3d9ace9a01c1b9e575a6aa7f41
                                                                                                                                                              • Instruction Fuzzy Hash: AF517F30E003099FDB05DFB8E848B9DBBF6FF89300F109569E505AB264DB75A989CB50
                                                                                                                                                              Function 017B8DA8 Relevance: .1, Instructions: 136COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 07c8ec9162212b0af9051b24110b762934d94139c204092924822a665cb6fdfb
                                                                                                                                                              • Instruction ID: d31b742ded78a57a642eae99fa6eb2e76955cb68497be88f572e28a03c07706f
                                                                                                                                                              • Opcode Fuzzy Hash: 07c8ec9162212b0af9051b24110b762934d94139c204092924822a665cb6fdfb
                                                                                                                                                              • Instruction Fuzzy Hash: 15512E30610201CFDB18DF29D8D4666BBB6FF89321B048198E915DF3A9D730E852CF91
                                                                                                                                                              Function 017B61E0 Relevance: .1, Instructions: 127COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 024c2894169d733255eb60837f493d46489fe8b1055495add66bd7f55304ca52
                                                                                                                                                              • Instruction ID: 92b32794d483ea54033ba4aad5064062c739d02706af4bba9990d0b724feb806
                                                                                                                                                              • Opcode Fuzzy Hash: 024c2894169d733255eb60837f493d46489fe8b1055495add66bd7f55304ca52
                                                                                                                                                              • Instruction Fuzzy Hash: 81515C30E403099FDB04DFB8E848B9DBBB2FF88300F109659E504BB264DB75A985CB50
                                                                                                                                                              Function 017BDAD8 Relevance: .1, Instructions: 116COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 3e2366d2afe38c54e49ffb4a265e1b21cb0e1260521edc87e9844f70949000fd
                                                                                                                                                              • Instruction ID: 4303110ea912dcca2ae653f8f150b24aab1a39632884b7e21cdc8d3b64d26225
                                                                                                                                                              • Opcode Fuzzy Hash: 3e2366d2afe38c54e49ffb4a265e1b21cb0e1260521edc87e9844f70949000fd
                                                                                                                                                              • Instruction Fuzzy Hash: 7F410834700205DFDB24DB99D4C4AAABBF6EBCC318B548099E905DB355DB31ED028B60
                                                                                                                                                              Function 017BE5E8 Relevance: .1, Instructions: 112COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 38cd8852fc9350b8d3e3a0ada1b9a99ea3367aa621aa71785f552398901f1bc0
                                                                                                                                                              • Instruction ID: 76242bd9b81072aefc79e20c33bd5d3127d31a003ba0d10b26309b1e59648a11
                                                                                                                                                              • Opcode Fuzzy Hash: 38cd8852fc9350b8d3e3a0ada1b9a99ea3367aa621aa71785f552398901f1bc0
                                                                                                                                                              • Instruction Fuzzy Hash: 504100306001018FDF18DF29D4D869ABBB1EF89325B1481A5E811DF3E9DB30E952CF91
                                                                                                                                                              Function 017B4CA8 Relevance: .1, Instructions: 110COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 5ed5266243073dbecfdc904f3f4c587ee381ee77b5dc8dcb3cb72d9a14cac67d
                                                                                                                                                              • Instruction ID: 71be01ed0211272efd1c761c5e02307e7e3af8a98ad210511da6dba6a4c5e271
                                                                                                                                                              • Opcode Fuzzy Hash: 5ed5266243073dbecfdc904f3f4c587ee381ee77b5dc8dcb3cb72d9a14cac67d
                                                                                                                                                              • Instruction Fuzzy Hash: 1D314A31B002068FDB189F69C4987AEFBF6AF89354F108469E607EB395DB70DC448B91
                                                                                                                                                              Function 05B696D0 Relevance: .1, Instructions: 103COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 65d2c3b4e8c9f0761f223e41ec535d6500cac7fc735c65cc1c26cdb72f0a5ae9
                                                                                                                                                              • Instruction ID: a38bf1d26496336288f6bda2160f3ba8fb58ed497becef41ddd40844b16dfb7d
                                                                                                                                                              • Opcode Fuzzy Hash: 65d2c3b4e8c9f0761f223e41ec535d6500cac7fc735c65cc1c26cdb72f0a5ae9
                                                                                                                                                              • Instruction Fuzzy Hash: 5A31AE357093448FC715DB68D85492ABFFAEF8A214719C8EAE089CF362CA35EC05C791
                                                                                                                                                              Function 017BDEB0 Relevance: .1, Instructions: 103COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: a19f540c685b4386116040329d2d944328e8646d07e2ff7cfbfe3ea48bac9118
                                                                                                                                                              • Instruction ID: 58ea85184a58b95075d161d7180043b9c76463bea573a7029e28b4f9c7884650
                                                                                                                                                              • Opcode Fuzzy Hash: a19f540c685b4386116040329d2d944328e8646d07e2ff7cfbfe3ea48bac9118
                                                                                                                                                              • Instruction Fuzzy Hash: EC416F3560460ADFCB11CF58C8808AABBB1FF49314B24C49DF9599B361D732E916CB50
                                                                                                                                                              Function 017B0A10 Relevance: .1, Instructions: 100COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: ae5c737729543be5d3362baefc8caee77be2cbfe4e67ee5d7168f7991ad1e8da
                                                                                                                                                              • Instruction ID: 120f262a2ba14960f46cba51d8f3bfdfc19d6eeb05c2fe0ae71ff291bcff5a50
                                                                                                                                                              • Opcode Fuzzy Hash: ae5c737729543be5d3362baefc8caee77be2cbfe4e67ee5d7168f7991ad1e8da
                                                                                                                                                              • Instruction Fuzzy Hash: E7416F74E012199FDB58DFAAD984AEEFBF2BF88300F14812AE815A7354DB345942CF50
                                                                                                                                                              Function 05B62C81 Relevance: .1, Instructions: 97COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: b086786185173adbb0a341d0b38afbb99eeed6d68d77307dc2677f574bf158f3
                                                                                                                                                              • Instruction ID: d953b3a43780c04a0e7860721d62df1a99a2744efecd643fd996d3cac066b1a7
                                                                                                                                                              • Opcode Fuzzy Hash: b086786185173adbb0a341d0b38afbb99eeed6d68d77307dc2677f574bf158f3
                                                                                                                                                              • Instruction Fuzzy Hash: 9541D276E002099FCB15DFA9C9849EEFBF6FF88310B15806AE515B7251DB34A940CBA0
                                                                                                                                                              Function 017B9140 Relevance: .1, Instructions: 87COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 50411547ed2bc94a8bdc812dd6c980861f423da5c54cc1706bd3453bd1f88b44
                                                                                                                                                              • Instruction ID: 1b764ac5732f34006c9574965ee75143f9a70d9064e1de0ac91cb9803be4bf72
                                                                                                                                                              • Opcode Fuzzy Hash: 50411547ed2bc94a8bdc812dd6c980861f423da5c54cc1706bd3453bd1f88b44
                                                                                                                                                              • Instruction Fuzzy Hash: E231EC70A007058FC730DF6AC88869AB7F1AF89324B144A6CD666DB7A5D730E946CF90
                                                                                                                                                              Function 05B63198 Relevance: .1, Instructions: 84COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 232f691fef48508f6a1cf6e028d80dfe79a825d82447f3a24ffb85a411b6a32a
                                                                                                                                                              • Instruction ID: 9b9b926faa0264f8fc91787e7eb855568bf04e4647c6d05db1151d7b38c1adcb
                                                                                                                                                              • Opcode Fuzzy Hash: 232f691fef48508f6a1cf6e028d80dfe79a825d82447f3a24ffb85a411b6a32a
                                                                                                                                                              • Instruction Fuzzy Hash: 0531AC75604209AFDB64DF54D884FEE37FAEB89300F508664E806DB695D775BC80CBA0
                                                                                                                                                              Function 017B8FC0 Relevance: .1, Instructions: 84COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 6e0b8abb4226c122c31a53f74abcb8476a6c3ee60e5fb7d39f7645a9e59415d0
                                                                                                                                                              • Instruction ID: 964e39b31cc2487a48dd646ad3cdb393c843e2f304ac79f90706ac96f1d6c737
                                                                                                                                                              • Opcode Fuzzy Hash: 6e0b8abb4226c122c31a53f74abcb8476a6c3ee60e5fb7d39f7645a9e59415d0
                                                                                                                                                              • Instruction Fuzzy Hash: D23100706007068FC730DF29C484696B7F1EF89324B108A6DD6A6DB7A5D731E946CF90
                                                                                                                                                              Function 017B0A00 Relevance: .1, Instructions: 77COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 8958511e8d252138fe9f9349961c44178b378e75074e4f2652731ba255b3cb98
                                                                                                                                                              • Instruction ID: 1f0c9d391460b919482e444560cce27b6cff462eff63a8a60e26a84cb3ae1e80
                                                                                                                                                              • Opcode Fuzzy Hash: 8958511e8d252138fe9f9349961c44178b378e75074e4f2652731ba255b3cb98
                                                                                                                                                              • Instruction Fuzzy Hash: 983127B0E052588FDB19CFBAC8446EEFBF2AF89300F04C16AE414A7260DB345906CF60
                                                                                                                                                              Function 017B92B8 Relevance: .1, Instructions: 77COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: d9db41a88d1de6d09d9ffc093ff5b544f8858249bef38591a8f342d6832ee628
                                                                                                                                                              • Instruction ID: ef7d0fcaf6559b2d0ff758e439f02c83d6b9d29129e3e13fa07f139ce137602a
                                                                                                                                                              • Opcode Fuzzy Hash: d9db41a88d1de6d09d9ffc093ff5b544f8858249bef38591a8f342d6832ee628
                                                                                                                                                              • Instruction Fuzzy Hash: 312147B0A067018BD734DF29D9847AAFBF5AB89224B045A2CD666C73D4D730E904CB90
                                                                                                                                                              Function 05B62859 Relevance: .1, Instructions: 75COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 4a94e1619d3d89e3d31173f6c9922dcdf86d5babf81f9fec1b570da036627174
                                                                                                                                                              • Instruction ID: 8bbd59ec4b002f1cad5d0e9c3c9df5b8ee51e51fe7c5f2d63b6fdf6eb569127c
                                                                                                                                                              • Opcode Fuzzy Hash: 4a94e1619d3d89e3d31173f6c9922dcdf86d5babf81f9fec1b570da036627174
                                                                                                                                                              • Instruction Fuzzy Hash: F521B0757046416BD7289B65DC64B2DFBB2FFCA321F208669E55AC7380DB30B841CB50
                                                                                                                                                              Function 05B67F32 Relevance: .1, Instructions: 70COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: edb8fdc509fb8e73fb85eb30191c6b6f26402755aab29c7bfb2fe3d5c3ebf871
                                                                                                                                                              • Instruction ID: eeaf8b91c66a6dabb704124c18f417beb5164f16ef9b77ea6b8c688315fe44fd
                                                                                                                                                              • Opcode Fuzzy Hash: edb8fdc509fb8e73fb85eb30191c6b6f26402755aab29c7bfb2fe3d5c3ebf871
                                                                                                                                                              • Instruction Fuzzy Hash: 4121D231605A868FC311DB18C590C66BBF5FF45314329C69AE8A9C7751EB35FC42CB80
                                                                                                                                                              Function 017B53C8 Relevance: .1, Instructions: 70COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 4cf38420672dd100b4a8e0e0d3ea7661ad21b3ac86f1a45f4c2805856d51c7ee
                                                                                                                                                              • Instruction ID: 82b70777b2cbca77cabe6efc6324a778e42466e3bd2783b4fabe1bc87bf1851a
                                                                                                                                                              • Opcode Fuzzy Hash: 4cf38420672dd100b4a8e0e0d3ea7661ad21b3ac86f1a45f4c2805856d51c7ee
                                                                                                                                                              • Instruction Fuzzy Hash: F7218E30600205CFDF28CF28D9C4A9ABF75EF49331F0482A9E9159B2D9DB75D852CBA0
                                                                                                                                                              Function 017B89C0 Relevance: .1, Instructions: 66COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: adc84dbd4bd4d8e35b07d28cc4ffeaaa09a691d6df36088d693a5a05d620635a
                                                                                                                                                              • Instruction ID: e00687130a6efb138cef53d7d405a8df83c641b70568a461d65ac40eade60434
                                                                                                                                                              • Opcode Fuzzy Hash: adc84dbd4bd4d8e35b07d28cc4ffeaaa09a691d6df36088d693a5a05d620635a
                                                                                                                                                              • Instruction Fuzzy Hash: 69215E357002058BCB45DF6DD49499EFBE6EF85250305C46AEC19CB36AEB30ED088B91
                                                                                                                                                              Function 017B7253 Relevance: .1, Instructions: 66COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 8273da2fe697728c5367ba17a1c2156c2f6196d30683cea7a2e62724b5f753a2
                                                                                                                                                              • Instruction ID: 18385a662873a9b4c8058f95ea23ee6089e8ba84262ccbc31bb49d68445668a2
                                                                                                                                                              • Opcode Fuzzy Hash: 8273da2fe697728c5367ba17a1c2156c2f6196d30683cea7a2e62724b5f753a2
                                                                                                                                                              • Instruction Fuzzy Hash: 8421AE716082058FC715CF18D89469AFBF2EFC9214F2484AEE809DB391D732EC06CB61
                                                                                                                                                              Function 05B64958 Relevance: .1, Instructions: 65COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 77d4a1006299b5870ed920a98f942a8f9a1c79056539264461d0a0f7d6c219d5
                                                                                                                                                              • Instruction ID: 23ef91d6f3ba91d5c5c3f0ef299e67d12621a4bce8e1c04dbde4c0d12c6dc719
                                                                                                                                                              • Opcode Fuzzy Hash: 77d4a1006299b5870ed920a98f942a8f9a1c79056539264461d0a0f7d6c219d5
                                                                                                                                                              • Instruction Fuzzy Hash: E4118C317087108FCF05DB38A894A26BBEAEFC5254B0584EAE444C7396DA36EC42C391
                                                                                                                                                              Function 017B4E70 Relevance: .1, Instructions: 64COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 1b4083cd39607d60027aebc1e59adbf875c2f80603f8aa7340282051ec3a3abd
                                                                                                                                                              • Instruction ID: 5b4415bebd85dd343cb108e895953787406857c33ce588fee12690bed914701e
                                                                                                                                                              • Opcode Fuzzy Hash: 1b4083cd39607d60027aebc1e59adbf875c2f80603f8aa7340282051ec3a3abd
                                                                                                                                                              • Instruction Fuzzy Hash: E0212C302007058FD735CF69D988A96FBB1EF45320F048A6DE553976A5DB31E94ACF90
                                                                                                                                                              Function 05B63C18 Relevance: .1, Instructions: 59COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 9a69e425514779321c99d0560b9f13b73ed473512282b2ade2cc1541dc9e8e0a
                                                                                                                                                              • Instruction ID: 43c89948677f061ddc2cffcaed6f18c4df4db47e6e923cd4e695878a30ddc136
                                                                                                                                                              • Opcode Fuzzy Hash: 9a69e425514779321c99d0560b9f13b73ed473512282b2ade2cc1541dc9e8e0a
                                                                                                                                                              • Instruction Fuzzy Hash: 490184773042009F8709D66DF85896AF7EAFBD927431580ABE509C7361CA36AC0287A5
                                                                                                                                                              Function 05B67A70 Relevance: .1, Instructions: 57COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: c5e62425a0be9f5496d346e706adbb0dc7a146c66ea3f28aacc74e68df901ff9
                                                                                                                                                              • Instruction ID: 375c9840256190a695d0e44c208d521ae840c30c1e8720f1c56e9f364337ecfd
                                                                                                                                                              • Opcode Fuzzy Hash: c5e62425a0be9f5496d346e706adbb0dc7a146c66ea3f28aacc74e68df901ff9
                                                                                                                                                              • Instruction Fuzzy Hash: DE116B32A04249AFCB05DB6998598BEBFA6FF8524075480F9D404DB261DF39ED06CBA1
                                                                                                                                                              Function 017B0839 Relevance: .1, Instructions: 55COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: a3b0da06f5f6b869aa099978010d6c75062faadb43abca54b0b97ad98cb20bd6
                                                                                                                                                              • Instruction ID: c1c84811f6178709721439ed87595515286d51ed0581e45c7b93edb8d80825e0
                                                                                                                                                              • Opcode Fuzzy Hash: a3b0da06f5f6b869aa099978010d6c75062faadb43abca54b0b97ad98cb20bd6
                                                                                                                                                              • Instruction Fuzzy Hash: 23114C74E0020A9FCB04DFA8D4546AEFBB2FF89300F118469D819A7350DB34AA01CB91
                                                                                                                                                              Function 05B697D8 Relevance: .1, Instructions: 51COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 8ed1118a3c950b9bacc8e4ad5f84e334e18eb0fede497f3e4ce9239217973b64
                                                                                                                                                              • Instruction ID: 33be53154c64e801252a8d146069c7cd7f61da633625c0e96fa849f81a9ffc0f
                                                                                                                                                              • Opcode Fuzzy Hash: 8ed1118a3c950b9bacc8e4ad5f84e334e18eb0fede497f3e4ce9239217973b64
                                                                                                                                                              • Instruction Fuzzy Hash: 8A014031B002198BCF14DBA9E8485BFF77AFBC5661F144566E916E3284DB3459018BE1
                                                                                                                                                              Function 05B69748 Relevance: .0, Instructions: 50COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 71439becf1c04cac5be3d52545459fbd10363bf7b3a78070ea9d094cafb94520
                                                                                                                                                              • Instruction ID: 78e21cc5f1e4d7033fecd58dfbd8777652b3bf514e5da904ad7ed111e7a79623
                                                                                                                                                              • Opcode Fuzzy Hash: 71439becf1c04cac5be3d52545459fbd10363bf7b3a78070ea9d094cafb94520
                                                                                                                                                              • Instruction Fuzzy Hash: 29011E367002049FD754DB79D898C2FBBEAEFC961431584B9E509CB365CA35EC028B90
                                                                                                                                                              Function 017B0848 Relevance: .0, Instructions: 50COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: f39043394cc47f4a329799b5994bc5a7219f930d535f6ad2158ce7b98e94b077
                                                                                                                                                              • Instruction ID: f87958c69e3d38d70ab2b99203be65cdfc6b62d88f57ef8c968b008e8e2bf339
                                                                                                                                                              • Opcode Fuzzy Hash: f39043394cc47f4a329799b5994bc5a7219f930d535f6ad2158ce7b98e94b077
                                                                                                                                                              • Instruction Fuzzy Hash: 3211E8B4E0020A9FCB44DFA9D555AAEFBB5FF89300F10C469D919A7364DB34AA01CF91
                                                                                                                                                              Function 0175D005 Relevance: .0, Instructions: 47COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737576825.000000000175D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0175D000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_175d000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 4051572b73074f6f97a25f61133387c56445afcb04fcfeb55ac96deee1c71823
                                                                                                                                                              • Instruction ID: dc8802ee3650d236b877968056fb697cfb22695984335e4c771db0c2121dbde5
                                                                                                                                                              • Opcode Fuzzy Hash: 4051572b73074f6f97a25f61133387c56445afcb04fcfeb55ac96deee1c71823
                                                                                                                                                              • Instruction Fuzzy Hash: A4015B6100D3C05EE7128A658C94652BFA4EF43224F0984DBE9888F2A7C2695845C771
                                                                                                                                                              Function 05B67A62 Relevance: .0, Instructions: 45COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 0d6c1e6b709d81e511c1aff5b3e0a9dae4ee74c6c96597fe7e1676bf1e1f78f2
                                                                                                                                                              • Instruction ID: d1505b6f4059dacd3bc6820e767085f95a7488774ea725c32a993e25624d156e
                                                                                                                                                              • Opcode Fuzzy Hash: 0d6c1e6b709d81e511c1aff5b3e0a9dae4ee74c6c96597fe7e1676bf1e1f78f2
                                                                                                                                                              • Instruction Fuzzy Hash: 71012D36A04209AFC701DB65DC489AFFFBAFB853107158075EA04E7360EB35AD05C7A1
                                                                                                                                                              Function 0175D01D Relevance: .0, Instructions: 45COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737576825.000000000175D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0175D000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_175d000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: c5f7a38849c62f4387cd53c8984936a0716c48322d698ed3521382620b21bffb
                                                                                                                                                              • Instruction ID: 9ceab99da6ed6417f120bd214f7aa4fd567acca0eacc9888f8fe2e55b29242f4
                                                                                                                                                              • Opcode Fuzzy Hash: c5f7a38849c62f4387cd53c8984936a0716c48322d698ed3521382620b21bffb
                                                                                                                                                              • Instruction Fuzzy Hash: DB012B715083409AE7704AA9CD84B67FF98EF413A4F08C469ED0D4F286C2B9D841C6B1
                                                                                                                                                              Function 017B71F4 Relevance: .0, Instructions: 42COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: f0c55b4759db95998259ee22c1168a3b4739275471ef2d733c51d0fd7e11c7a5
                                                                                                                                                              • Instruction ID: 177387c1137fa4800316b3631033316883e5159ac0a0bf59f9ae3290fae15d55
                                                                                                                                                              • Opcode Fuzzy Hash: f0c55b4759db95998259ee22c1168a3b4739275471ef2d733c51d0fd7e11c7a5
                                                                                                                                                              • Instruction Fuzzy Hash: B20116347402098FDB18CF58C598BEAF7B2AB8A354F109458E902E7394CB30DD01CB60
                                                                                                                                                              Function 05B63BA0 Relevance: .0, Instructions: 40COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: dce2028fa514df11d7233b4b2f13d0c73e7e702d420e5789648f022fce3b3caa
                                                                                                                                                              • Instruction ID: 6fc9f4134330755c34110d698b3c5cfe35afffc671a26000425f44dc9cab4015
                                                                                                                                                              • Opcode Fuzzy Hash: dce2028fa514df11d7233b4b2f13d0c73e7e702d420e5789648f022fce3b3caa
                                                                                                                                                              • Instruction Fuzzy Hash: F6F0F6723083401FC712966EE855D5BBFAEFBC16A434444AEE549CB324EE78FC048790
                                                                                                                                                              Function 05B63BB0 Relevance: .0, Instructions: 34COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: a1ae45f459ee7c5de0c1932105681ca77ca02ec6468b7fae70c0481e41127dda
                                                                                                                                                              • Instruction ID: 41750d84403f352c29d5fde547385a3a3d7deaadecfdb4e2f46bd28d754d8646
                                                                                                                                                              • Opcode Fuzzy Hash: a1ae45f459ee7c5de0c1932105681ca77ca02ec6468b7fae70c0481e41127dda
                                                                                                                                                              • Instruction Fuzzy Hash: F9F082313043015B8721966EA895C5BFBDEFBC46A0344446DE50DC7324DE79FC058794
                                                                                                                                                              Function 017B18C8 Relevance: .0, Instructions: 34COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: dc37d71e20abb5fb5082efe5787b9dd5f9b9fe654f4fa8f5fdd90f3aabe3624c
                                                                                                                                                              • Instruction ID: 36631ba147770668c21b72bc0cf08064db234bcaeee7abee60cbf8ff6c7d06b5
                                                                                                                                                              • Opcode Fuzzy Hash: dc37d71e20abb5fb5082efe5787b9dd5f9b9fe654f4fa8f5fdd90f3aabe3624c
                                                                                                                                                              • Instruction Fuzzy Hash: DFF0F6313007410BC726966DB42869EFBAAFB89290314907CDC5987345DF34DC008BC5
                                                                                                                                                              Function 05B62810 Relevance: .0, Instructions: 33COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 7658bd437776ed97afe349deae1499fcd931796b44485fed6a6803b7f84e8a2d
                                                                                                                                                              • Instruction ID: 929036fbe1b832a1ace51e62f748fc9473574a29f6f8e2c2817820681281617b
                                                                                                                                                              • Opcode Fuzzy Hash: 7658bd437776ed97afe349deae1499fcd931796b44485fed6a6803b7f84e8a2d
                                                                                                                                                              • Instruction Fuzzy Hash: 55F0E5307427107FC3226615A808B5ABBA99FCAA10F11409AE1499B391CEA1BC02C794
                                                                                                                                                              Function 017B18D8 Relevance: .0, Instructions: 31COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 974941a414bbf8db003011798f6433db0804db1a57d56a997e2ca4117d098a58
                                                                                                                                                              • Instruction ID: 2b97d71667a13b3baf6878af54679de37dce1ad7b11f42cd7bac405dd5118744
                                                                                                                                                              • Opcode Fuzzy Hash: 974941a414bbf8db003011798f6433db0804db1a57d56a997e2ca4117d098a58
                                                                                                                                                              • Instruction Fuzzy Hash: 08F0A7313007014F8726D62DB41869EF79EFBC92A03509039D85AC7314EF34DC058BD1
                                                                                                                                                              Function 017BBEB1 Relevance: .0, Instructions: 31COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: a2bf3641a6d6fb845d12a95565d7c7fee22d9568d567b74e971849303caf12d1
                                                                                                                                                              • Instruction ID: e88c64d2546bf03de0cb274fc041bf412a5426e77d39caf1064eb3145cb488f3
                                                                                                                                                              • Opcode Fuzzy Hash: a2bf3641a6d6fb845d12a95565d7c7fee22d9568d567b74e971849303caf12d1
                                                                                                                                                              • Instruction Fuzzy Hash: 68F04974D0020A9FDB64DFACC8857AEBBB0AB08320F604A59D924E7391E77095418F90
                                                                                                                                                              Function 017BBEC0 Relevance: .0, Instructions: 30COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: df40df874c875f7aaabc63ccc270d9c828a621275bad35cb36cdc44158070c77
                                                                                                                                                              • Instruction ID: fd22cfce500a57759b25ad542d8cd250128fb1976bbe98acf66757e9fdd1d6fb
                                                                                                                                                              • Opcode Fuzzy Hash: df40df874c875f7aaabc63ccc270d9c828a621275bad35cb36cdc44158070c77
                                                                                                                                                              • Instruction Fuzzy Hash: D4F03070D0020ADFDB64DFADC4857AEBBF0AB08320F204659D924E7391D77195418F91
                                                                                                                                                              Function 05B6379C Relevance: .0, Instructions: 29COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 85659bdda4e731eead5e80d0b768c3ff249cd37fb3edf0d0238749b140b10407
                                                                                                                                                              • Instruction ID: 2c580a362cc0a83ca14551af89275d4f5810a0fe7a4908e6f568d2ac8208f750
                                                                                                                                                              • Opcode Fuzzy Hash: 85659bdda4e731eead5e80d0b768c3ff249cd37fb3edf0d0238749b140b10407
                                                                                                                                                              • Instruction Fuzzy Hash: AFF0396160E3D01FC7039B6C98701DA7F715FA3240B1B44D3C0C0CF2A7C618580AC3A6
                                                                                                                                                              Function 017BD708 Relevance: .0, Instructions: 26COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 014db7fca6d954578de411315141bf3594648ab78f86884742cac6f2bcf940c8
                                                                                                                                                              • Instruction ID: 937414284b36d924004aeee211aa35b336c82d8a6968ca4e5ce3b87bce8b5828
                                                                                                                                                              • Opcode Fuzzy Hash: 014db7fca6d954578de411315141bf3594648ab78f86884742cac6f2bcf940c8
                                                                                                                                                              • Instruction Fuzzy Hash: 18F01570E083489FCB41EBA8D41959DFFF1AF5A300F1185EAE405DB361DA345A888B81
                                                                                                                                                              Function 017BBF38 Relevance: .0, Instructions: 26COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 06f6adad8fb045476afaa8e4bc38ad3db9c62f5aa448b39b9dc05d6a2af9f712
                                                                                                                                                              • Instruction ID: 3b7d9149ca9d36de4ce6436f7f8f7cce6d4ca8497e998d2b5396678ae0465a5b
                                                                                                                                                              • Opcode Fuzzy Hash: 06f6adad8fb045476afaa8e4bc38ad3db9c62f5aa448b39b9dc05d6a2af9f712
                                                                                                                                                              • Instruction Fuzzy Hash: EDF01C70D04209DFCB50DFACD9857AEBFF0AB08210F100A99E918E3291D77196408FC1
                                                                                                                                                              Function 05B62820 Relevance: .0, Instructions: 25COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 7e7ff8c7db26f3c06d7cc0f45ea3db9c3945e8bb5a6c31faeed6e4a57c62c386
                                                                                                                                                              • Instruction ID: c453d65aa95cb6ae75d3994a6271ba7247373aaacfdbabbb0b75175e461dbfa7
                                                                                                                                                              • Opcode Fuzzy Hash: 7e7ff8c7db26f3c06d7cc0f45ea3db9c3945e8bb5a6c31faeed6e4a57c62c386
                                                                                                                                                              • Instruction Fuzzy Hash: 32E086357417147BC7256615AC05F1ABBAADFCAF11F2040ADF5099B790CF61BC02C795
                                                                                                                                                              Function 05B67FA0 Relevance: .0, Instructions: 25COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: a385a50a1beca6f1104236e72f772a5e824c216b772ef7b0c8a19ee5265fc0c3
                                                                                                                                                              • Instruction ID: 77abae1f5322f1329cd9208caac323119fe3c75444be3bf5d976945b3ce0c719
                                                                                                                                                              • Opcode Fuzzy Hash: a385a50a1beca6f1104236e72f772a5e824c216b772ef7b0c8a19ee5265fc0c3
                                                                                                                                                              • Instruction Fuzzy Hash: 39E08C32B058D75BCB10811C9845D65B6CAE759268B3C86B1F828C7380FE29EC0387E0
                                                                                                                                                              Function 05B67110 Relevance: .0, Instructions: 24COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: cfbc22a0b84475ed00dfe615cc98a82f17c1708388b0ee3f5945ce6905762efd
                                                                                                                                                              • Instruction ID: 76ebaeb46c315e655582c2ca65e4204723000aae04aeca6f6508cec1421ddef2
                                                                                                                                                              • Opcode Fuzzy Hash: cfbc22a0b84475ed00dfe615cc98a82f17c1708388b0ee3f5945ce6905762efd
                                                                                                                                                              • Instruction Fuzzy Hash: A0E09231B05750CFC72AAB38A11455B3BB2EB8920130144FBE449CB391CE30FC41CB82
                                                                                                                                                              Function 05B6370F Relevance: .0, Instructions: 24COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: e3c380080e7dd5a6201b0ab0f1eb5db5203c23f5751e83d9c8494edeff52c8ad
                                                                                                                                                              • Instruction ID: 164f1d87614ba470b694b96baaa41a4bc25ce151ec244e13f0c24071a9ad3350
                                                                                                                                                              • Opcode Fuzzy Hash: e3c380080e7dd5a6201b0ab0f1eb5db5203c23f5751e83d9c8494edeff52c8ad
                                                                                                                                                              • Instruction Fuzzy Hash: 37E02D8A64F7C00FC7034A65AC616D5BF751A63652B9B90C7C0C0CB2F3D549581E8766
                                                                                                                                                              Function 017BBF29 Relevance: .0, Instructions: 24COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: eab478e92b7b1dcfe08390ad04b7dd9acfd5e483f0bf2ddbc839f1056827e9a3
                                                                                                                                                              • Instruction ID: 1bb541fbd55973e0ec5b01b89d69e78d52ad8ac861699961508ba0135af5d761
                                                                                                                                                              • Opcode Fuzzy Hash: eab478e92b7b1dcfe08390ad04b7dd9acfd5e483f0bf2ddbc839f1056827e9a3
                                                                                                                                                              • Instruction Fuzzy Hash: 07F058B0D0025ACFCB50DFACC9897AEFFB0BB04220F604A99E815E3291D7719640CF80
                                                                                                                                                              Function 017B597C Relevance: .0, Instructions: 22COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 6c599301cf98dee2f7b52691113bc858e8d844f5153c661b14bdd494b8e5db2a
                                                                                                                                                              • Instruction ID: a8bbc2d3746b90ce5a24d22168f111ddad4d2e69a1cee3a50bc3a9de57df2b90
                                                                                                                                                              • Opcode Fuzzy Hash: 6c599301cf98dee2f7b52691113bc858e8d844f5153c661b14bdd494b8e5db2a
                                                                                                                                                              • Instruction Fuzzy Hash: 94E026639481948FD301836C5CD52A0FFA4C52224834802C5D8089B225E231E91AA3A1
                                                                                                                                                              Function 017B0E70 Relevance: .0, Instructions: 21COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 410d31b660f6ae00aa46f2dbf3e1a0b327419d775303d3a2be908827b8f6a4ee
                                                                                                                                                              • Instruction ID: 29dc9020556263bf455273fa48af117917e0616a5b958cb25ec2163c219a0ceb
                                                                                                                                                              • Opcode Fuzzy Hash: 410d31b660f6ae00aa46f2dbf3e1a0b327419d775303d3a2be908827b8f6a4ee
                                                                                                                                                              • Instruction Fuzzy Hash: 88E04F3090030CAFCB40EB68E94865DF7B9EB44220F1041A9D809D7324EB705E049B91
                                                                                                                                                              Function 017B5910 Relevance: .0, Instructions: 21COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 188df0a91b1bf0bb825b13a641231000642d3c06546c131ac6a51c3e1f67d2d2
                                                                                                                                                              • Instruction ID: 1dc0c3771f2a9177adb20477becc1ca7bc7bff2e970d2477cff0a18cf7a3a3e7
                                                                                                                                                              • Opcode Fuzzy Hash: 188df0a91b1bf0bb825b13a641231000642d3c06546c131ac6a51c3e1f67d2d2
                                                                                                                                                              • Instruction Fuzzy Hash: 5AE0867160524CEFCB41DFA8E94975DFFF9EB45200F1042A9DC08A7315EB316E209791
                                                                                                                                                              Function 05B635B0 Relevance: .0, Instructions: 20COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 5667e08186c5f8ee3ac0c6c238a520c1281aa695c20ea2a4132f1f1d8bd929ee
                                                                                                                                                              • Instruction ID: 3a9bbd550e8ee03ff370bb074b44a55ec92e57762287fcd6da9eafcb1fb1f28f
                                                                                                                                                              • Opcode Fuzzy Hash: 5667e08186c5f8ee3ac0c6c238a520c1281aa695c20ea2a4132f1f1d8bd929ee
                                                                                                                                                              • Instruction Fuzzy Hash: E1E0D830909388EFC711DFB8D94518CFFB4EB4220070000E9D448E3366EA302E009740
                                                                                                                                                              Function 017BD718 Relevance: .0, Instructions: 19COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: a550f614078c1cae52d5de9b3eff5bdf54a8923b7cd31670bd81688a8baefe8b
                                                                                                                                                              • Instruction ID: 06641cc59660200236009413587b696bdfc0cffba6ca939b8b03dc51dee87a09
                                                                                                                                                              • Opcode Fuzzy Hash: a550f614078c1cae52d5de9b3eff5bdf54a8923b7cd31670bd81688a8baefe8b
                                                                                                                                                              • Instruction Fuzzy Hash: 56E09274E0420CAFCB54EFA8D94559DFBF5AB48300F0081A9E809E7364EA346A448F81
                                                                                                                                                              Function 05B635C0 Relevance: .0, Instructions: 16COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: cabbdf01fdab4c7650f42a5cf2c8a1022d456978e08defd8a42f9c812f6e16ae
                                                                                                                                                              • Instruction ID: 5d2733fe0bc20444b30030988c65247f50db4ea36d08a5e87d3f54e689ce2604
                                                                                                                                                              • Opcode Fuzzy Hash: cabbdf01fdab4c7650f42a5cf2c8a1022d456978e08defd8a42f9c812f6e16ae
                                                                                                                                                              • Instruction Fuzzy Hash: 2DD01730A0120DEF8B40EFA9EA4659DFBB9EB84200B1041B89809E3315EA316E009B80
                                                                                                                                                              Function 017B0E80 Relevance: .0, Instructions: 16COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: ff22e99bc9f93ff414bfd62310ba304b579f3ca47b8a9e8f45b59e02e72711da
                                                                                                                                                              • Instruction ID: 70c7b9d140f04337f2952d852dad12403cace8c66f55261a1ad949a16a19cb08
                                                                                                                                                              • Opcode Fuzzy Hash: ff22e99bc9f93ff414bfd62310ba304b579f3ca47b8a9e8f45b59e02e72711da
                                                                                                                                                              • Instruction Fuzzy Hash: 7DD05E30A0030CEFCB40EFACE90495DF7F9EB44250B2091A8D80ED3318EA316F009B90
                                                                                                                                                              Function 017BD6E0 Relevance: .0, Instructions: 16COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: eadb058fa96a504bc418349c6a8b51dee76c8aa976b55788ad713b2e6df7a1cc
                                                                                                                                                              • Instruction ID: 54d4e8ef2b99700d68abae80b7656c65c6421b970e8c0f6a9397647a3709180b
                                                                                                                                                              • Opcode Fuzzy Hash: eadb058fa96a504bc418349c6a8b51dee76c8aa976b55788ad713b2e6df7a1cc
                                                                                                                                                              • Instruction Fuzzy Hash: 68D0A771809F840FC3118BA55A15154FF709E63300B1555D7D484CF372C4668C408382
                                                                                                                                                              Function 017B5920 Relevance: .0, Instructions: 16COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: fbf548c2d031210bcc6fb25d1f6ec5f1719301df9f53e8d6d5286d59d5ecec08
                                                                                                                                                              • Instruction ID: 95527d6a5db75f28003aded68e95b1bbb667eb19edae0a085c63e743c3363fba
                                                                                                                                                              • Opcode Fuzzy Hash: fbf548c2d031210bcc6fb25d1f6ec5f1719301df9f53e8d6d5286d59d5ecec08
                                                                                                                                                              • Instruction Fuzzy Hash: 7AD05E31A0120CEFCB40EFA8EA4A55DFBF9EB45200B1045A9D80CE3310EA72AF109B90
                                                                                                                                                              Function 017B19E0 Relevance: .0, Instructions: 12COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 0055a5810a7231c17fb6c49b60146eec90e4669c001e961c9ca7e0ce2ee975b9
                                                                                                                                                              • Instruction ID: c73fe328372052cf3d8f70576dc0e03babb1b0c452452d6ed69a3443ee5fcebe
                                                                                                                                                              • Opcode Fuzzy Hash: 0055a5810a7231c17fb6c49b60146eec90e4669c001e961c9ca7e0ce2ee975b9
                                                                                                                                                              • Instruction Fuzzy Hash: D6C04CB665000067CB14CE70CD65B91B755EBAA30DF28C8A9E809DB385DB27FA038740
                                                                                                                                                              Function 05B69A33 Relevance: .0, Instructions: 11COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 1facf67c7bf838177740dcb87449149b70110376888f69e30c6ad6a137441b74
                                                                                                                                                              • Instruction ID: 9cc6cf746924a6dc4be7e80deb7e8764fd03a5b8ffb6df1806dc2df97681e9ba
                                                                                                                                                              • Opcode Fuzzy Hash: 1facf67c7bf838177740dcb87449149b70110376888f69e30c6ad6a137441b74
                                                                                                                                                              • Instruction Fuzzy Hash: 83D0927498420ACFEB248F80C1597EEBFB0FB04325F280459D102A5290C7BD2189CFD0
                                                                                                                                                              Function 05B69A17 Relevance: .0, Instructions: 11COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 6e52cc182f6679f166b48c1eca5be385faacd0915035844a3b87c995fbe28429
                                                                                                                                                              • Instruction ID: 1daf060ac5f9fe592000441e4e41e3d93cd17a6a75eac736a25a2a01bc321284
                                                                                                                                                              • Opcode Fuzzy Hash: 6e52cc182f6679f166b48c1eca5be385faacd0915035844a3b87c995fbe28429
                                                                                                                                                              • Instruction Fuzzy Hash: B7D0927498420ACFEB208F80C159BEEBFB0FB04315F284459D102A5290CBB82189CFD0
                                                                                                                                                              Function 05B69A6B Relevance: .0, Instructions: 11COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 7f8b8afc6ae5aa07a306d236160a858a7f10cff7a4d44c1d3c59a7cb0e1f8dbb
                                                                                                                                                              • Instruction ID: 6ff56f488c0d4778fde2bb05ff3520e814d9b31219a969165cebc0d2e2cbe625
                                                                                                                                                              • Opcode Fuzzy Hash: 7f8b8afc6ae5aa07a306d236160a858a7f10cff7a4d44c1d3c59a7cb0e1f8dbb
                                                                                                                                                              • Instruction Fuzzy Hash: AED0927498420ACFEB208F80C1597EEBFF1FB04325F280459D102A5290C7B82189CFD4
                                                                                                                                                              Function 05B69A4F Relevance: .0, Instructions: 11COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 11399a1ac022165b11a75b5d2b00c505292b2b9dd6f1f80aca16ef3af3dcb909
                                                                                                                                                              • Instruction ID: a7148e7b3008b3cf17c03170c753db28eaaa23c14d0669a3e1a380e1e0ac26a0
                                                                                                                                                              • Opcode Fuzzy Hash: 11399a1ac022165b11a75b5d2b00c505292b2b9dd6f1f80aca16ef3af3dcb909
                                                                                                                                                              • Instruction Fuzzy Hash: 0DD0927498420ACFEB248F80C1597EEBFB0FB04315F280459D102A5290C7B82189CFD0
                                                                                                                                                              Function 017B9D70 Relevance: .0, Instructions: 11COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 5075246b08c80a3691d5acef98c71dcd56ce8987248733b7649ece89f7405177
                                                                                                                                                              • Instruction ID: c49c7284a58ca6c1b01f5289677523949a7d28fe905affab4d7c5ae18b021a9e
                                                                                                                                                              • Opcode Fuzzy Hash: 5075246b08c80a3691d5acef98c71dcd56ce8987248733b7649ece89f7405177
                                                                                                                                                              • Instruction Fuzzy Hash: 5DD0A96240C3804FCB028A2898202AA3F306B22230B2A43C2C0E08F1E3D2148901E751
                                                                                                                                                              Function 017B9D98 Relevance: .0, Instructions: 10COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: d5a17fbc23a2d17aacea0a7487013ae0d0f32ef2ff2c1ce5a8ab908513581da6
                                                                                                                                                              • Instruction ID: 9873cab9595e023e9156fe6bcacb7bef130b5e2a7dcb9014a63f0ec7a19a5b9f
                                                                                                                                                              • Opcode Fuzzy Hash: d5a17fbc23a2d17aacea0a7487013ae0d0f32ef2ff2c1ce5a8ab908513581da6
                                                                                                                                                              • Instruction Fuzzy Hash: DCC0123211C7450EC782676CB4698043F35D91122170507E5E5258D4F2D628E988E349
                                                                                                                                                              Function 05B61BF6 Relevance: .0, Instructions: 9COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: b425f2d0a16c36af12d2c9b009ba08331f1e4b855890c3497d17d0be70aeab32
                                                                                                                                                              • Instruction ID: cd450f8d87f18f8059dca24d2eb3b00cee483f91aff1bc03797e00b3b5149dd2
                                                                                                                                                              • Opcode Fuzzy Hash: b425f2d0a16c36af12d2c9b009ba08331f1e4b855890c3497d17d0be70aeab32
                                                                                                                                                              • Instruction Fuzzy Hash: 5DC0483AE04009DB8F00DA84F8858DCFB31EB8422AB208162E619A35108A312A6B8B80
                                                                                                                                                              Function 017BD6F0 Relevance: .0, Instructions: 9COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: f483fa0d1799f4c79b7155f48c251ad39a2db572fcadd605266a27a8386a517c
                                                                                                                                                              • Instruction ID: 8852bc75330cb5a187c575a93f3f2af58861646f397a09c9751e9f2e8b52842f
                                                                                                                                                              • Opcode Fuzzy Hash: f483fa0d1799f4c79b7155f48c251ad39a2db572fcadd605266a27a8386a517c
                                                                                                                                                              • Instruction Fuzzy Hash: BEB0927094530CAF8620DB99990185ABBACDA0A310F0001D9F90887320D976E91056D1
                                                                                                                                                              Function 05B63CB0 Relevance: .0, Instructions: 8COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: cb8efe06e4cb7fe4d5e92f3b82cf1ddda633a06a2948983885b4008ccb89f297
                                                                                                                                                              • Instruction ID: 2959f30882bcc1bf23d7f4df45671d4060967af687a909acb62abae99f7fd25f
                                                                                                                                                              • Opcode Fuzzy Hash: cb8efe06e4cb7fe4d5e92f3b82cf1ddda633a06a2948983885b4008ccb89f297
                                                                                                                                                              • Instruction Fuzzy Hash: 27C08C3250C4805BCB20CB18C88679EBB31BF80300F1A806ED44467648CB307800CB86
                                                                                                                                                              Function 05B6A070 Relevance: .0, Instructions: 8COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 835b64b5254cbfea0e1ceef9bdf2dab595ef7ece80eff8ee48616287fbdaa3ed
                                                                                                                                                              • Instruction ID: b01d8318097a5fc993435344127c835fa62dbb73848e731861ca2ba72903e46d
                                                                                                                                                              • Opcode Fuzzy Hash: 835b64b5254cbfea0e1ceef9bdf2dab595ef7ece80eff8ee48616287fbdaa3ed
                                                                                                                                                              • Instruction Fuzzy Hash: 25C04C3050AB908FC31A5B3084155127F726FA320579D48EDC8824A292E73AF815C742
                                                                                                                                                              Function 017B9DA8 Relevance: .0, Instructions: 7COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1737814495.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_17b0000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 8f6015d287a7c9e982e39c68319b6a33bce64e65aba90b25d54183fd7dea6705
                                                                                                                                                              • Instruction ID: bffe7e4ee95b0b7fd0a1e900d8694592c5fa04e3b6dd1d7e3904135ca7635835
                                                                                                                                                              • Opcode Fuzzy Hash: 8f6015d287a7c9e982e39c68319b6a33bce64e65aba90b25d54183fd7dea6705
                                                                                                                                                              • Instruction Fuzzy Hash: 2DB0123106870E4FC6407758F419A14BB6CE5402057401520F50E4A5359F78FCC84688

                                                                                                                                                              Non-executed Functions

                                                                                                                                                              Function 05B61E9B Relevance: 1.8, Strings: 1, Instructions: 545COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000000.00000002.1764866244.0000000005B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B60000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_0_2_5b60000_NotaFiscalOnline.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: 4'^q
                                                                                                                                                              • API String ID: 0-1614139903
                                                                                                                                                              • Opcode ID: f76d47f4b78a6e998a51a26b1712447c956552ddd4112792b6ecc0a1e400d5e6
                                                                                                                                                              • Instruction ID: 48bdb4e69a05dd1f526c1dc711789f0e147c11ad090959bacff69dea5b884e74
                                                                                                                                                              • Opcode Fuzzy Hash: f76d47f4b78a6e998a51a26b1712447c956552ddd4112792b6ecc0a1e400d5e6
                                                                                                                                                              • Instruction Fuzzy Hash: 0222F7757002148FDB29DB38C594A6DB7F2EF89214F1485A8E50AAB3A5DF35ED82CF40

                                                                                                                                                              Executed Functions

                                                                                                                                                              Function 074A28B4 Relevance: 2.7, Strings: 2, Instructions: 223COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: (bq$LR^q
                                                                                                                                                              • API String ID: 0-516514815
                                                                                                                                                              • Opcode ID: 1c0a1136ace6e96f8a132fd2ae5347bd799382f46b7dad214cfb0fff7ccf089e
                                                                                                                                                              • Instruction ID: 96415005647c6af92c2831b365b9433fb0046c17cb505c3dde590db849ec905b
                                                                                                                                                              • Opcode Fuzzy Hash: 1c0a1136ace6e96f8a132fd2ae5347bd799382f46b7dad214cfb0fff7ccf089e
                                                                                                                                                              • Instruction Fuzzy Hash: 076128717043556FDB095B3498243FF7BAABBD6610F0484AFE806CB396DEA88C459392
                                                                                                                                                              Function 074A1630 Relevance: 2.7, Strings: 2, Instructions: 160COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: $^q$$^q
                                                                                                                                                              • API String ID: 0-355816377
                                                                                                                                                              • Opcode ID: 0e0c35648025e2ca738f03ee21d68e33e48d7a5aca2ecc4d1c67b7df60a0f1f7
                                                                                                                                                              • Instruction ID: 9855f1e6d43499c3f80f001c9a34675ec86d67c3d2368f7b534fa489ab5c37bf
                                                                                                                                                              • Opcode Fuzzy Hash: 0e0c35648025e2ca738f03ee21d68e33e48d7a5aca2ecc4d1c67b7df60a0f1f7
                                                                                                                                                              • Instruction Fuzzy Hash: D051D0B5B00209AFC715DF79D8406EEBBB6BFD9250F14812BE908DB364DA309D42C7A1
                                                                                                                                                              Function 074A50D0 Relevance: 2.6, Strings: 2, Instructions: 98COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: $^q$$^q
                                                                                                                                                              • API String ID: 0-355816377
                                                                                                                                                              • Opcode ID: 51f30b16ca17dd6e0b9c7b42644c13b4a98de841311dc62ecf724409a693fe41
                                                                                                                                                              • Instruction ID: eb8a78885ff985600f4053e12e4d363312e6cfa929df026113b4433b9326bcfa
                                                                                                                                                              • Opcode Fuzzy Hash: 51f30b16ca17dd6e0b9c7b42644c13b4a98de841311dc62ecf724409a693fe41
                                                                                                                                                              • Instruction Fuzzy Hash: 6C319370E10209EFDB189B75D9946EEB7F2BF88304F14C42AD802AB395CF349846CB91
                                                                                                                                                              Function 074A6508 Relevance: 1.5, Strings: 1, Instructions: 241COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: LR^q
                                                                                                                                                              • API String ID: 0-2625958711
                                                                                                                                                              • Opcode ID: 33b234702a1049b1d2888ef23c769d3431ae5c553b49d608d2ceb4a7a3bdb8f2
                                                                                                                                                              • Instruction ID: dffc8c36dee4f83404294b291954e879c49b523b3c1ffe56c46c310fa9ae8926
                                                                                                                                                              • Opcode Fuzzy Hash: 33b234702a1049b1d2888ef23c769d3431ae5c553b49d608d2ceb4a7a3bdb8f2
                                                                                                                                                              • Instruction Fuzzy Hash: AD91E2B0B20215EFDB149F64E858BAEBBB2BF94704F15842ED4169B390CB359C45CB92
                                                                                                                                                              Function 074A1080 Relevance: 1.5, Strings: 1, Instructions: 212COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: (bq
                                                                                                                                                              • API String ID: 0-149360118
                                                                                                                                                              • Opcode ID: ff5b97fc2e4dda074c8b7cdaae29818c0e250b3e7a431757a4f407bb95249d7a
                                                                                                                                                              • Instruction ID: 85debddcbc668d726cd7935224699063afad5eaf8b509e5300db6d9277d61237
                                                                                                                                                              • Opcode Fuzzy Hash: ff5b97fc2e4dda074c8b7cdaae29818c0e250b3e7a431757a4f407bb95249d7a
                                                                                                                                                              • Instruction Fuzzy Hash: A67192B1B00218EFDB08ABB5C8546AEB7F7AFD8300F14842AD506EB3A4DE35DD528751
                                                                                                                                                              Function 074A2878 Relevance: 1.4, Strings: 1, Instructions: 116COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: LR^q
                                                                                                                                                              • API String ID: 0-2625958711
                                                                                                                                                              • Opcode ID: af9d9b0c4205d967e4e00f06fa7859053cb2ea9431dbb0af99377c0f03b202b5
                                                                                                                                                              • Instruction ID: 83d91b40ebb15a2d41c7210b62d75b86df51d35f6dc8f4ef91d66d6bab6e958e
                                                                                                                                                              • Opcode Fuzzy Hash: af9d9b0c4205d967e4e00f06fa7859053cb2ea9431dbb0af99377c0f03b202b5
                                                                                                                                                              • Instruction Fuzzy Hash: C0313AB17093A16FDB059B389C607FF7BF6BFD2210F04046FE455C72A6EA6488498395
                                                                                                                                                              Function 074A0C1C Relevance: 1.4, Strings: 1, Instructions: 110COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: (bq
                                                                                                                                                              • API String ID: 0-149360118
                                                                                                                                                              • Opcode ID: f6f42def85e3be3cc621c4b84023111775e1293257e3bb793a6a8d3bb31783e6
                                                                                                                                                              • Instruction ID: 9db0d1a7f3dbbd352628cc11d9689e47ed72b6a8c9628c56222d1ab9d0625f18
                                                                                                                                                              • Opcode Fuzzy Hash: f6f42def85e3be3cc621c4b84023111775e1293257e3bb793a6a8d3bb31783e6
                                                                                                                                                              • Instruction Fuzzy Hash: 00312270B08299ABD719663954243EF7BF69BD6210F1484AFD502DB386DE794C0583A2
                                                                                                                                                              Function 074A50BF Relevance: 1.4, Strings: 1, Instructions: 108COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: $^q
                                                                                                                                                              • API String ID: 0-388095546
                                                                                                                                                              • Opcode ID: 40927ff7f3b956120e5b88398a24b7140b392e64c974e21670fba65776b2b5e8
                                                                                                                                                              • Instruction ID: 3f46570be2e8cd61892c6ce3ad73f8fba2dd1cf1637382797c8ba30d75edf95a
                                                                                                                                                              • Opcode Fuzzy Hash: 40927ff7f3b956120e5b88398a24b7140b392e64c974e21670fba65776b2b5e8
                                                                                                                                                              • Instruction Fuzzy Hash: A231A370E10209EFDB189B75D9946FEB7E2BF98314F14C42AD802AB355DB349846CB91
                                                                                                                                                              Function 074A2D60 Relevance: 1.3, Strings: 1, Instructions: 91COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: LR^q
                                                                                                                                                              • API String ID: 0-2625958711
                                                                                                                                                              • Opcode ID: c9e6ca2d7458b05ebce9393c344cfa9d81f410d0357cf9770f65fd49d821f8a5
                                                                                                                                                              • Instruction ID: f1e07d758832c924d510f327b1fa11837712430f119a5fa11437b5ba646e08fd
                                                                                                                                                              • Opcode Fuzzy Hash: c9e6ca2d7458b05ebce9393c344cfa9d81f410d0357cf9770f65fd49d821f8a5
                                                                                                                                                              • Instruction Fuzzy Hash: EC21E0B2B00216AFDB089B39A8547FF77EAFFD5600F10442FE416C7395EAB489459391
                                                                                                                                                              Function 074A28C4 Relevance: 1.3, Strings: 1, Instructions: 91COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: (bq
                                                                                                                                                              • API String ID: 0-149360118
                                                                                                                                                              • Opcode ID: 58ea82d09bb0558982902a409abc92a9717a0be1a299818e77d17b3d2865d18c
                                                                                                                                                              • Instruction ID: 229073d5e8ee76fdf76744db2c45cee6e5e2b57d1c651ebeda8b6741d26ab4c6
                                                                                                                                                              • Opcode Fuzzy Hash: 58ea82d09bb0558982902a409abc92a9717a0be1a299818e77d17b3d2865d18c
                                                                                                                                                              • Instruction Fuzzy Hash: 302138B1B08364ABD7056A3654546FF7BAAEBE6250F04802BE905C7391CE389801C3A6
                                                                                                                                                              Function 074A8A10 Relevance: 1.3, Strings: 1, Instructions: 86COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: LR^q
                                                                                                                                                              • API String ID: 0-2625958711
                                                                                                                                                              • Opcode ID: 83ff9e5a6c8348d3c2b47b39f5ad30e6cc5a64c922fd64f0452de82f1c23df7d
                                                                                                                                                              • Instruction ID: cc054959c525471218aa2ffc43b07458c840e278de4b5be751c94bbe033f53a5
                                                                                                                                                              • Opcode Fuzzy Hash: 83ff9e5a6c8348d3c2b47b39f5ad30e6cc5a64c922fd64f0452de82f1c23df7d
                                                                                                                                                              • Instruction Fuzzy Hash: 7121C170B10209ABDB19CBA1E8597EE77BBEB89700F10842AE502A7380DF745D06CB91
                                                                                                                                                              Function 074A8A20 Relevance: 1.3, Strings: 1, Instructions: 78COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: LR^q
                                                                                                                                                              • API String ID: 0-2625958711
                                                                                                                                                              • Opcode ID: 845c7ba916f4e353cd2bc31b665ef7d6f3ad6191754b63e6d61fd6f6f06514d2
                                                                                                                                                              • Instruction ID: 9337d2029b77209642ab138396dada33d933bf1e767b7aed1379b788d80f850a
                                                                                                                                                              • Opcode Fuzzy Hash: 845c7ba916f4e353cd2bc31b665ef7d6f3ad6191754b63e6d61fd6f6f06514d2
                                                                                                                                                              • Instruction Fuzzy Hash: F0217170B10209EBDB09DB61E4557EE77BBEB98700F208429E402A7380DF745D06CB96
                                                                                                                                                              Function 074A29C8 Relevance: .2, Instructions: 228COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 235ae121dd54340b047162746e3d2a89e2b089dda5d9c2e8d922d87910a0eac4
                                                                                                                                                              • Instruction ID: 82f5a2e5f705c8436afd5dee43ebdf451ea56aeaedede244ba0df41d76852c77
                                                                                                                                                              • Opcode Fuzzy Hash: 235ae121dd54340b047162746e3d2a89e2b089dda5d9c2e8d922d87910a0eac4
                                                                                                                                                              • Instruction Fuzzy Hash: C7919E71A00605DFCB04DF79C8905AEB7B2FF98310B10C66AE909AB354EB74ED85CB90
                                                                                                                                                              Function 074A6EA0 Relevance: .2, Instructions: 197COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: d61127834b57e4ad023abac5a3b40ffbd1fae231f2febe6813eb93e606f469ab
                                                                                                                                                              • Instruction ID: 9e32a9322b9cc72b09e14f7cf7fa86e08ee445a55ad8e99097663a388665f004
                                                                                                                                                              • Opcode Fuzzy Hash: d61127834b57e4ad023abac5a3b40ffbd1fae231f2febe6813eb93e606f469ab
                                                                                                                                                              • Instruction Fuzzy Hash: 3B713731D553859FD702DF78D854BC9BFB2FF86310F14819AD044AB2A2E778A948CBA1
                                                                                                                                                              Function 074A29A1 Relevance: .2, Instructions: 164COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: abae5f28dbfdb6ed2d7133c946ba34d0efb8208a3b73a5a2c531d95f8d6245e7
                                                                                                                                                              • Instruction ID: d5ea819c9f5b620f56d1f7998bd33e86ff055ce627d8e76b944741f139f7fead
                                                                                                                                                              • Opcode Fuzzy Hash: abae5f28dbfdb6ed2d7133c946ba34d0efb8208a3b73a5a2c531d95f8d6245e7
                                                                                                                                                              • Instruction Fuzzy Hash: 92518DB57002109FCB05DF39D9906AABBB2FF88610704C5AAE849DF355DB74EC46CBA1
                                                                                                                                                              Function 074A6F78 Relevance: .1, Instructions: 139COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 6e26c941ba660bedbf2009091ea71db94a6613361292647b54bd92882115872f
                                                                                                                                                              • Instruction ID: 55e3e9b3f0fcd2e658ef162933c29537c388d935eb4a0f57e93b868fd2daf22c
                                                                                                                                                              • Opcode Fuzzy Hash: 6e26c941ba660bedbf2009091ea71db94a6613361292647b54bd92882115872f
                                                                                                                                                              • Instruction Fuzzy Hash: 31516031E502099FDB04DFB4D954BDDBBB2FF89300F108559E114AB390EB79A989CBA1
                                                                                                                                                              Function 074A2268 Relevance: .1, Instructions: 106COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: cd6c013aa20fa409317c79ae631bed3e9734b223a1f90e6b82b813f87cf30dbd
                                                                                                                                                              • Instruction ID: 41a3851f949d515bf55bea6e291bcb4161781740a9c423a879a6d6c83b74238f
                                                                                                                                                              • Opcode Fuzzy Hash: cd6c013aa20fa409317c79ae631bed3e9734b223a1f90e6b82b813f87cf30dbd
                                                                                                                                                              • Instruction Fuzzy Hash: A141F775B10118AFCB54DF79D88099EB7B6FF99710B10816AE905EB360EB31DD42CB90
                                                                                                                                                              Function 074A6390 Relevance: .1, Instructions: 101COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: bdcc5c10a4709d8241449e454e9d187f7ece02482badf3e7eb9b5aaae0826c1a
                                                                                                                                                              • Instruction ID: 7d30e4a61ee7be07a8c38853d61925c485ef9e99c5458b314783d4bb61ee6f07
                                                                                                                                                              • Opcode Fuzzy Hash: bdcc5c10a4709d8241449e454e9d187f7ece02482badf3e7eb9b5aaae0826c1a
                                                                                                                                                              • Instruction Fuzzy Hash: 8941D674A10218EFCB04DFA9D5849DEBBF6FF98310B15806AE905E7325DA31EC41CBA5
                                                                                                                                                              Function 074A28E4 Relevance: .1, Instructions: 93COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 7e3f67b5c8249bf885825e64f5006cbae14a4765321e201ddafedd07c7a68d6e
                                                                                                                                                              • Instruction ID: 768bc4dad0b9384242d1cd42a4e4368ff8a373e241259b7ec7fec0835031f17e
                                                                                                                                                              • Opcode Fuzzy Hash: 7e3f67b5c8249bf885825e64f5006cbae14a4765321e201ddafedd07c7a68d6e
                                                                                                                                                              • Instruction Fuzzy Hash: A721917160536ABFD70626B524107F77F59EF92230F10807BFE48D6255D9688891E3E2
                                                                                                                                                              Function 074A63A0 Relevance: .1, Instructions: 91COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 2ec2a290efe8381839208224481c1320feab815453ea79b5a9f0142f419c02a9
                                                                                                                                                              • Instruction ID: 537a1913db27b45ce93dd9d186f4e5bb1173b7f9db08630e663809005c1733e7
                                                                                                                                                              • Opcode Fuzzy Hash: 2ec2a290efe8381839208224481c1320feab815453ea79b5a9f0142f419c02a9
                                                                                                                                                              • Instruction Fuzzy Hash: 1C31E674A10218EFCB04DFA9D58499EBBF6FF98310B15806AE905E7325DB30EC41CBA1
                                                                                                                                                              Function 074A9340 Relevance: .1, Instructions: 86COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 4a2859a877ebc140e5d91c42a76c61d7b9a32f08d3f66276dabd317fd21c25fc
                                                                                                                                                              • Instruction ID: 4be19b198d7471e5d1a71abcc9e0bac64b16fab730f5c8a1e80b4658492625b7
                                                                                                                                                              • Opcode Fuzzy Hash: 4a2859a877ebc140e5d91c42a76c61d7b9a32f08d3f66276dabd317fd21c25fc
                                                                                                                                                              • Instruction Fuzzy Hash: 80214F75B093A06FC7065A3558546FF7F6AAFE6150B08406BE941C7381CD385901C3F2
                                                                                                                                                              Function 074A306F Relevance: .1, Instructions: 72COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 1ac90a1f1f34a178d307171f7783b1b08c43b536671d51ae2c17824029055f7e
                                                                                                                                                              • Instruction ID: 9fbca3d431e0a4a870e44ce803405e0e010dc6affd57702956f58d5fcf9dde6b
                                                                                                                                                              • Opcode Fuzzy Hash: 1ac90a1f1f34a178d307171f7783b1b08c43b536671d51ae2c17824029055f7e
                                                                                                                                                              • Instruction Fuzzy Hash: 5F21D371B00159EFCB04EBA5D850AEABBF7EFCC311F14402AE405E7380DE7998418BA1
                                                                                                                                                              Function 074A9440 Relevance: .1, Instructions: 70COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: ebd38091e5055e37595576b2aeab447a54b44a78579bc0d3781399f14aba1488
                                                                                                                                                              • Instruction ID: 5fb7cd027ba5dd0cd72b9b40ca659db466b62ac3894da882a4be494e39c0e765
                                                                                                                                                              • Opcode Fuzzy Hash: ebd38091e5055e37595576b2aeab447a54b44a78579bc0d3781399f14aba1488
                                                                                                                                                              • Instruction Fuzzy Hash: 5A219271A00119FFDB08EB65D451AEAB7B6EFD8321F10402AE505E7381DB79A845CBA2
                                                                                                                                                              Function 074A2258 Relevance: .1, Instructions: 68COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: eb01c1debe27f46fd2b5e76aa3f2035fcfc6bdf055420bf19176212d65402ebf
                                                                                                                                                              • Instruction ID: 80423651ed55c9110c8296f5843bce1b6810929182aa726014be47a0d3b7f4a4
                                                                                                                                                              • Opcode Fuzzy Hash: eb01c1debe27f46fd2b5e76aa3f2035fcfc6bdf055420bf19176212d65402ebf
                                                                                                                                                              • Instruction Fuzzy Hash: D2213E75A10214AFCB44DF79D8419DEBBB2FF9C714B10816AE905E7360DB319842CB90
                                                                                                                                                              Function 074A2CC2 Relevance: .1, Instructions: 64COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 2955fb823348c7899f06f99afcb4bdeccc678f3021a8eb14ebaef326f7a55557
                                                                                                                                                              • Instruction ID: c4c60d732f9018ce6b88fa756892898565f5bf0371f59087911933f4747c2731
                                                                                                                                                              • Opcode Fuzzy Hash: 2955fb823348c7899f06f99afcb4bdeccc678f3021a8eb14ebaef326f7a55557
                                                                                                                                                              • Instruction Fuzzy Hash: 1C112976B00519A7CF189A64D8103EEBBB5BFD8221F00457AD415FB295CF758841C7E5
                                                                                                                                                              Function 074A3080 Relevance: .1, Instructions: 59COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: a9ccbeb03dbfbe61ab52211a107394df23738d5d29f9e761c15df458e4f15ac9
                                                                                                                                                              • Instruction ID: db8987e703ba7e6398fc683927969df9bfb617283c026d855f8fa7c14647aad6
                                                                                                                                                              • Opcode Fuzzy Hash: a9ccbeb03dbfbe61ab52211a107394df23738d5d29f9e761c15df458e4f15ac9
                                                                                                                                                              • Instruction Fuzzy Hash: 42117274A00109EFDB08EB65C850AEEBBF7AFDC310F14802AD405E7391DE799845CB91
                                                                                                                                                              Function 074A9450 Relevance: .1, Instructions: 57COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 744c26a4fc6b0dc87a29eb1eaed039ce2dec30bea00b53e003b97b56d7f2853b
                                                                                                                                                              • Instruction ID: 56f7a395cbccbfff442f260e434ab70b576f14d1268d610e4c6e42bfae8fa75a
                                                                                                                                                              • Opcode Fuzzy Hash: 744c26a4fc6b0dc87a29eb1eaed039ce2dec30bea00b53e003b97b56d7f2853b
                                                                                                                                                              • Instruction Fuzzy Hash: 0C117F70A00158EFDB08EB65C451AAABBF7AFDC310F14401AE509E7381DF79A845CB92
                                                                                                                                                              Function 074A1378 Relevance: .1, Instructions: 55COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 00403be8f8e3688073ab43f36b7881ad54fa2b2b7967596322688118e45eba4f
                                                                                                                                                              • Instruction ID: 05a8a477c51bd6033bd1d9b8568f1509aa285e13deb2a9ae3166ae23381fda2d
                                                                                                                                                              • Opcode Fuzzy Hash: 00403be8f8e3688073ab43f36b7881ad54fa2b2b7967596322688118e45eba4f
                                                                                                                                                              • Instruction Fuzzy Hash: 0D2102B1D042498EDB14DFAAC484AEEFBF0FF98324F14842ED859A7240C7756946CFA5
                                                                                                                                                              Function 074A2CD0 Relevance: .1, Instructions: 55COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: e62886f398cc3f6a85e960d44d11b7a4d5ad915120fc2ced38cabbce0f90c5e4
                                                                                                                                                              • Instruction ID: d83132621b2ef2747f83ebc508174172316112313df5eb18c5c43bc05b53b758
                                                                                                                                                              • Opcode Fuzzy Hash: e62886f398cc3f6a85e960d44d11b7a4d5ad915120fc2ced38cabbce0f90c5e4
                                                                                                                                                              • Instruction Fuzzy Hash: BE010472B001189BDF188AA9C8102EEB7F2FBCC315F04843BC409F7254DB799842C7A5
                                                                                                                                                              Function 074A1380 Relevance: .1, Instructions: 53COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 274ccf71296a683e0b490c53e02d9caab9885adc69063c5296e0ab273fcb5071
                                                                                                                                                              • Instruction ID: 4a3b5d006669faf410c7ea05c50519498708530fa5f1b91f29d7d0af31332e48
                                                                                                                                                              • Opcode Fuzzy Hash: 274ccf71296a683e0b490c53e02d9caab9885adc69063c5296e0ab273fcb5071
                                                                                                                                                              • Instruction Fuzzy Hash: 3D1106B1D042599FDB10DFAAC884ADEFBF4FF48324F10842AD45967250CB746945CFA5
                                                                                                                                                              Function 074A8038 Relevance: .1, Instructions: 53COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 9518e5bc51ad331d9ca52b8b6ebbae8b90425a400b6c67c436abf9c6b794955c
                                                                                                                                                              • Instruction ID: a052a8195701c05215363b958bbe2ddb2cf18be93bc2bbbaadc98dc99b263a77
                                                                                                                                                              • Opcode Fuzzy Hash: 9518e5bc51ad331d9ca52b8b6ebbae8b90425a400b6c67c436abf9c6b794955c
                                                                                                                                                              • Instruction Fuzzy Hash: 22017C76344110AB8708DA6DF4908AEB3EBFBD8274315C03BE609C7320DA37EC0297A4
                                                                                                                                                              Function 074A6A1F Relevance: .1, Instructions: 52COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: e20c4a91302da8769b29b012d49bbdbf1cac6750c46ea9ebf2d074a07e6aeddf
                                                                                                                                                              • Instruction ID: b9b722fe048a6640c938266f1324cde591f9f1162307d8768ebfc94285398421
                                                                                                                                                              • Opcode Fuzzy Hash: e20c4a91302da8769b29b012d49bbdbf1cac6750c46ea9ebf2d074a07e6aeddf
                                                                                                                                                              • Instruction Fuzzy Hash: 7F012271700108EBCB18AA6A84547DFBAE6DFDA211F24802ED401A7390CE744C06CBD2
                                                                                                                                                              Function 074A1968 Relevance: .1, Instructions: 51COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: fd4ba6d7443af6b5951ed5b63046963b854d5aba75991c41b3f41de1ead95826
                                                                                                                                                              • Instruction ID: 82fe6e499bdaa9e7ac4fe889db383e077f30fc8694658b2dc78ce5c23d86239a
                                                                                                                                                              • Opcode Fuzzy Hash: fd4ba6d7443af6b5951ed5b63046963b854d5aba75991c41b3f41de1ead95826
                                                                                                                                                              • Instruction Fuzzy Hash: F5118F31640144EFCB08DF64D459AA9BBF6EF8C310F24401AE40AE7390DB799855CBA1
                                                                                                                                                              Function 074A182A Relevance: .0, Instructions: 50COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: dc1c4ea2571c253262e7437054e8ed73492241e4f309645c5a5836ae7c308125
                                                                                                                                                              • Instruction ID: b9d86376db2a1ac46585b8981f352a72a110f73e3203061de87fc5103d445a78
                                                                                                                                                              • Opcode Fuzzy Hash: dc1c4ea2571c253262e7437054e8ed73492241e4f309645c5a5836ae7c308125
                                                                                                                                                              • Instruction Fuzzy Hash: 0401F7B1A1010DA7D718AA69D4557FF7AFA9BD9300F20403FD101E7790DE765C068BE2
                                                                                                                                                              Function 074A6B0C Relevance: .0, Instructions: 46COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: aa3eaad743d740c0a5c427b842f1fc37848a2a27e2ed00d7947f612d09cd9aa0
                                                                                                                                                              • Instruction ID: 2046c369023d017c7b560bc004ee4d880c89e846d3caa53e497ffc3cc7ed4690
                                                                                                                                                              • Opcode Fuzzy Hash: aa3eaad743d740c0a5c427b842f1fc37848a2a27e2ed00d7947f612d09cd9aa0
                                                                                                                                                              • Instruction Fuzzy Hash: C8F0D1F2B04334BBDB1526A55C117FA6B62DBE6310F0E856BD1099A7A0DA6694428383
                                                                                                                                                              Function 074A6A30 Relevance: .0, Instructions: 45COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 2e118f6d89ff2600e4a5c111717cebb6235e60af0fb3d3f07073b17b61cf849c
                                                                                                                                                              • Instruction ID: 6f8178232cbe3902662909420456e2ff7c427ad89fa8c3c567ffd51ecb28c2af
                                                                                                                                                              • Opcode Fuzzy Hash: 2e118f6d89ff2600e4a5c111717cebb6235e60af0fb3d3f07073b17b61cf849c
                                                                                                                                                              • Instruction Fuzzy Hash: 3301A2B1700208EBDB18AB6AC4547EF7AE69FDA210F25842ED406B7390DF755D05CBD2
                                                                                                                                                              Function 04ECD01D Relevance: .0, Instructions: 45COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000002.1752901050.0000000004ECD000.00000040.00000800.00020000.00000000.sdmp, Offset: 04ECD000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_2_4ecd000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 555a7e9d8f26d1d4d802bc1a25885ac7990c19a1a3b37cb6ddd4dd37d037c257
                                                                                                                                                              • Instruction ID: c8a49a47f0fa6363c9cad58e4366d2dfa9c90655d013bf47878fe76a1841413c
                                                                                                                                                              • Opcode Fuzzy Hash: 555a7e9d8f26d1d4d802bc1a25885ac7990c19a1a3b37cb6ddd4dd37d037c257
                                                                                                                                                              • Instruction Fuzzy Hash: 2C01F7315083009AE7104E2DDE85F67BF99DF41324F08C53EED084A246C27AA843C6B1
                                                                                                                                                              Function 04ECD005 Relevance: .0, Instructions: 45COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000002.1752901050.0000000004ECD000.00000040.00000800.00020000.00000000.sdmp, Offset: 04ECD000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_2_4ecd000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: ddfdf2901f7e889e1a006d898f8ab0fee7246d2135602a602604d90870b400c3
                                                                                                                                                              • Instruction ID: 5dbd47a3ec30f9b5331f01bac3850545dcef81a0cc8fd6f1faddb22d795d32a1
                                                                                                                                                              • Opcode Fuzzy Hash: ddfdf2901f7e889e1a006d898f8ab0fee7246d2135602a602604d90870b400c3
                                                                                                                                                              • Instruction Fuzzy Hash: E701927100E3C09EE7128B258D94B52BFB4DF53224F0DC1DBD8888F193C2695845C772
                                                                                                                                                              Function 074A7FB0 Relevance: .0, Instructions: 44COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: e5ef90006b4ff8879842a1b3fc79cbb61b9405055a7ac90a815e57ae3d9b53be
                                                                                                                                                              • Instruction ID: 08f5a5ee463456aef82d03b5cb250a6f65517206304b7322af1a26d0d02c2b30
                                                                                                                                                              • Opcode Fuzzy Hash: e5ef90006b4ff8879842a1b3fc79cbb61b9405055a7ac90a815e57ae3d9b53be
                                                                                                                                                              • Instruction Fuzzy Hash: 24F022B23402106FC722462EFC808CBBB9BEBD1220300803FE609C7740DE65980983E1
                                                                                                                                                              Function 074A1440 Relevance: .0, Instructions: 43COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 437369e8c40f5f41eb91f9a224d4256bd122bf7bee1ab01ce9a48ea31b4c8e2c
                                                                                                                                                              • Instruction ID: 65b113b4e0fd1e72ae4128ed3de156e65c1b387543eee16210832177e6e200c6
                                                                                                                                                              • Opcode Fuzzy Hash: 437369e8c40f5f41eb91f9a224d4256bd122bf7bee1ab01ce9a48ea31b4c8e2c
                                                                                                                                                              • Instruction Fuzzy Hash: 7B0167706493895FC70DAB7855751567FEA9E8260470908ABC185CF263F919C44AC793
                                                                                                                                                              Function 074A1431 Relevance: .0, Instructions: 38COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 6e3534ab2646a7d431cbdda762b1402cf9f47523a6cbade08d8019a749bf19c9
                                                                                                                                                              • Instruction ID: bfc7f01a33efe9e60c63dce38dc4b1fd83ab781ada9b138c29f8c58513cff2dc
                                                                                                                                                              • Opcode Fuzzy Hash: 6e3534ab2646a7d431cbdda762b1402cf9f47523a6cbade08d8019a749bf19c9
                                                                                                                                                              • Instruction Fuzzy Hash: 11F0FCB06443495FC70DAB785426166BFEAEEC161470408AFC145CF252F925C44687D3
                                                                                                                                                              Function 074A5278 Relevance: .0, Instructions: 34COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 09fe5ea55995104485a88f0f8e98ae81f0801f476e191b3cf5b8f16424dfc404
                                                                                                                                                              • Instruction ID: 07673788c046f76fb1bb049044979fae514e90a544ef1076441618dca1f47da8
                                                                                                                                                              • Opcode Fuzzy Hash: 09fe5ea55995104485a88f0f8e98ae81f0801f476e191b3cf5b8f16424dfc404
                                                                                                                                                              • Instruction Fuzzy Hash: A5F0273270D3402BC3058676E8109D7BBAADFD6225B10407AE108C7242C8255802C7B0
                                                                                                                                                              Function 074A7FC0 Relevance: .0, Instructions: 34COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 9a3d7ffc7264ea352b27c8e6b81c780f3750ae4dc84bec88b983502374950dd9
                                                                                                                                                              • Instruction ID: 53cf77a2dab29bbee581da06f1c4a50e76d1cff47ca7371115836ddd39e22ea1
                                                                                                                                                              • Opcode Fuzzy Hash: 9a3d7ffc7264ea352b27c8e6b81c780f3750ae4dc84bec88b983502374950dd9
                                                                                                                                                              • Instruction Fuzzy Hash: 22F082B2340611AB86269A5EF88089BBBDBFBD4620300843EE609C7344DF65AC0587E4
                                                                                                                                                              Function 074A28D4 Relevance: .0, Instructions: 29COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: fbe5e23f2ab67012ab9061f6dbc4c21419fc3074664bbd9ddcb01017059423c3
                                                                                                                                                              • Instruction ID: fd937004293cc3fba55d99ad32f0b604ea57208248acd3e702eac9a13530ecf3
                                                                                                                                                              • Opcode Fuzzy Hash: fbe5e23f2ab67012ab9061f6dbc4c21419fc3074664bbd9ddcb01017059423c3
                                                                                                                                                              • Instruction Fuzzy Hash: 1FE092B0714A1736EF28616999403E758CE6BF2B04F00057FF806C2B82E9C0D8413393
                                                                                                                                                              Function 074A5288 Relevance: .0, Instructions: 25COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: a12691d86b5a523dbe1d8fb86a4ff15fc6aed2d1cc512d3105280b182088663c
                                                                                                                                                              • Instruction ID: 5de6349fe5818cd7096bd3e218d5e7ac981c35479afc1bc8e599b34168ebbaf9
                                                                                                                                                              • Opcode Fuzzy Hash: a12691d86b5a523dbe1d8fb86a4ff15fc6aed2d1cc512d3105280b182088663c
                                                                                                                                                              • Instruction Fuzzy Hash: D5E086327052046BD3199A6BE85095BB3AFEBD9625B20847DE50CC7355CD769C4286A0
                                                                                                                                                              Function 074A7F3F Relevance: .0, Instructions: 25COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 12d7661e8bbfa1ae2e825eff9a32b42ba221b4d461a3e675692531ed058158d3
                                                                                                                                                              • Instruction ID: 4b138259ce91246589433ff3a117be903b510aec52116eb31f33b5f88961f322
                                                                                                                                                              • Opcode Fuzzy Hash: 12d7661e8bbfa1ae2e825eff9a32b42ba221b4d461a3e675692531ed058158d3
                                                                                                                                                              • Instruction Fuzzy Hash: DAE0927160A249AFCB02CB68ED125DEBFF9EB02214B0045EAD408D7252EB316F449B91
                                                                                                                                                              Function 074A2F80 Relevance: .0, Instructions: 24COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 0956f445640e1a2ae7463be6b8994e0eff95a36a254491cbea1c94e79232572d
                                                                                                                                                              • Instruction ID: f51abe8536fb635244f2b52bd1d213408eb90cf9d36e2fd396892264f029b202
                                                                                                                                                              • Opcode Fuzzy Hash: 0956f445640e1a2ae7463be6b8994e0eff95a36a254491cbea1c94e79232572d
                                                                                                                                                              • Instruction Fuzzy Hash: 17D02B666093226BCF0511B430002F2BF4C97A1421F1044D3F909CB60388A84C4023D6
                                                                                                                                                              Function 074A17F0 Relevance: .0, Instructions: 23COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: dd91dbad03c9507800b1fd40e1642c8eb7749f72233592e33f5f7fd2d17cc91e
                                                                                                                                                              • Instruction ID: 40cff430cc1f2587b42562c7e048a3d9e6fc6ef59e9e7d82d76b23f93a062a9c
                                                                                                                                                              • Opcode Fuzzy Hash: dd91dbad03c9507800b1fd40e1642c8eb7749f72233592e33f5f7fd2d17cc91e
                                                                                                                                                              • Instruction Fuzzy Hash: 30E02B3320E6A46FC30B1721BC114E57F79EB5B12130400A7FA81C76A2DD621D51C7F5
                                                                                                                                                              Function 074A2958 Relevance: .0, Instructions: 21COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 3a66f5bb8b9691053372dc1cb2ca2c4a27fcc77d2eda2e7c0ed10fa8357e22cd
                                                                                                                                                              • Instruction ID: d8000365f1290a816743196dda11d9166fba23ce2b47c63350a2371088fcf0b3
                                                                                                                                                              • Opcode Fuzzy Hash: 3a66f5bb8b9691053372dc1cb2ca2c4a27fcc77d2eda2e7c0ed10fa8357e22cd
                                                                                                                                                              • Instruction Fuzzy Hash: C0E04FB2D0624CAFCB00DBA4EA4259CBBB5EB41210B0144FAD80CD7651EA755E459796
                                                                                                                                                              Function 074A0C0C Relevance: .0, Instructions: 17COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: e54a51623a3dc8d1babdd24be3d1ed0acdd181b4d0884465d65182a126e05ac5
                                                                                                                                                              • Instruction ID: 05076669998a3aa2c7ffb2d37a9bb434ca414c2ab89af15da573ff01f0839451
                                                                                                                                                              • Opcode Fuzzy Hash: e54a51623a3dc8d1babdd24be3d1ed0acdd181b4d0884465d65182a126e05ac5
                                                                                                                                                              • Instruction Fuzzy Hash: 45D0A77225001C7B46096619D8858AAB7AAE7A6360B104437FA02C3224DE605C5583AA
                                                                                                                                                              Function 074A7F50 Relevance: .0, Instructions: 16COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: c2f035c3317d5d5cdb16632a6d88656c1319cf1d741d8c5bb726f3adc0ffcde0
                                                                                                                                                              • Instruction ID: 81e59405c17ea9416694bf4a6d3180930be0915d765a6c32d301954551f21f13
                                                                                                                                                              • Opcode Fuzzy Hash: c2f035c3317d5d5cdb16632a6d88656c1319cf1d741d8c5bb726f3adc0ffcde0
                                                                                                                                                              • Instruction Fuzzy Hash: 55D01271901108EFCB04DFA8EA0159DBBF9EB44204B1045A89408D3200EB316E049791
                                                                                                                                                              Function 074A2968 Relevance: .0, Instructions: 16COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: b037321776096039cb2a4d33cb1039c154a5724d46d8e26e2396c1a1affaef23
                                                                                                                                                              • Instruction ID: e34b66f76316f6b1b4a432dd356a17d7848693b2c72663e6802678e93d77b12f
                                                                                                                                                              • Opcode Fuzzy Hash: b037321776096039cb2a4d33cb1039c154a5724d46d8e26e2396c1a1affaef23
                                                                                                                                                              • Instruction Fuzzy Hash: D2D017B1A0220CEFCB00DFA8EA4259DBBBAEB44205B1085A9D80CD3240EA716E449B95
                                                                                                                                                              Function 074A0440 Relevance: .0, Instructions: 12COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000004.00000003.1751654294.00000000074A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_4_3_74a0000_rundll32.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: c41c3154c6a9576905fb2338f455bc2385c29bb168a418ba8363bdc53d6f4a74
                                                                                                                                                              • Instruction ID: d7b33ea953150528ae42e5fdcb8326e15a67893dd8d87a29b8985df7e804284d
                                                                                                                                                              • Opcode Fuzzy Hash: c41c3154c6a9576905fb2338f455bc2385c29bb168a418ba8363bdc53d6f4a74
                                                                                                                                                              • Instruction Fuzzy Hash: 43D0123505D3804FC717876098534C0BF31BA1232534942EFD04185453D62F4456C7B2

                                                                                                                                                              Execution Graph

                                                                                                                                                              Execution Coverage:7.6%
                                                                                                                                                              Dynamic/Decrypted Code Coverage:100%
                                                                                                                                                              Signature Coverage:4.1%
                                                                                                                                                              Total number of Nodes:146
                                                                                                                                                              Total number of Limit Nodes:8
                                                                                                                                                              execution_graph 44841 8c1238 44842 8c1249 44841->44842 44848 8c0e69 44842->44848 44854 8c0e61 44842->44854 44860 8c0e65 44842->44860 44866 8c0e24 44842->44866 44843 8c1282 44850 8c0e4e 44848->44850 44849 8c0e9e 44850->44849 44872 8c36a0 44850->44872 44876 8c36b0 44850->44876 44851 8c133b 44851->44843 44855 8c0e4e 44854->44855 44856 8c0e9e 44855->44856 44858 8c36a0 RtlGetVersion 44855->44858 44859 8c36b0 RtlGetVersion 44855->44859 44857 8c133b 44857->44843 44858->44857 44859->44857 44861 8c0e4e 44860->44861 44862 8c0e9e 44861->44862 44864 8c36a0 RtlGetVersion 44861->44864 44865 8c36b0 RtlGetVersion 44861->44865 44863 8c133b 44863->44843 44864->44863 44865->44863 44867 8c0e2d 44866->44867 44868 8c0d65 44867->44868 44870 8c36a0 RtlGetVersion 44867->44870 44871 8c36b0 RtlGetVersion 44867->44871 44869 8c133b 44869->44843 44870->44869 44871->44869 44873 8c36a3 44872->44873 44874 8c36cc 44872->44874 44873->44874 44880 8c4c67 44873->44880 44874->44851 44877 8c36c6 44876->44877 44879 8c4c67 RtlGetVersion 44877->44879 44878 8c36cc 44878->44851 44879->44878 44881 8c4c90 44880->44881 44882 8c4d1d RtlGetVersion 44881->44882 44884 8c4cc6 44881->44884 44883 8c4dda 44882->44883 44883->44874 44884->44874 44698 3790b30 44701 3790b60 44698->44701 44699 3790b55 44702 3790b8d 44701->44702 44703 3790b99 44701->44703 44702->44699 44707 3791178 44703->44707 44715 3791170 44703->44715 44704 3790c15 44704->44699 44708 379117b 44707->44708 44709 3791264 44708->44709 44712 3791178 CryptProtectData 44708->44712 44714 3791170 CryptProtectData 44708->44714 44724 37913cf 44708->44724 44728 3790e88 44709->44728 44712->44709 44714->44709 44717 3791174 44715->44717 44716 3791116 44716->44704 44717->44716 44718 3791264 44717->44718 44721 3791178 CryptProtectData 44717->44721 44722 37913cf CryptProtectData 44717->44722 44723 3791170 CryptProtectData 44717->44723 44719 3790e88 CryptProtectData 44718->44719 44720 379148d 44719->44720 44720->44704 44721->44718 44722->44718 44723->44718 44725 37913e3 44724->44725 44726 3790e88 CryptProtectData 44725->44726 44727 379148d 44726->44727 44727->44709 44729 3791678 CryptProtectData 44728->44729 44731 379148d 44729->44731 44731->44704 44837 50a2d50 44838 50a2daa 44837->44838 44839 50a2e09 RegDisablePredefinedCache 44838->44839 44840 50a2dec 44838->44840 44839->44840 44732 50b0bc0 44733 50b0bd0 44732->44733 44737 50b0ee0 44733->44737 44741 50b0ed0 44733->44741 44734 50b0bdb 44738 50b0f03 44737->44738 44745 50b1400 44738->44745 44742 50b0f03 44741->44742 44744 50b1400 2 API calls 44742->44744 44743 50b0f62 44744->44743 44749 50b1470 44745->44749 44752 50b1465 44745->44752 44750 50b14c4 ConnectNamedPipe 44749->44750 44751 50b1500 44750->44751 44751->44751 44753 50b14c4 ConnectNamedPipe 44752->44753 44754 50b1500 44753->44754 44754->44754 44755 50b0040 44756 50b0071 44755->44756 44757 50b0207 44756->44757 44763 50b197f 44756->44763 44767 50b1990 44756->44767 44771 50b2aef 44757->44771 44779 50b2a90 44757->44779 44758 50b0a4e 44764 50b199f 44763->44764 44788 50b19f1 44764->44788 44768 50b199f 44767->44768 44770 50b19f1 2 API calls 44768->44770 44769 50b19b4 44769->44757 44770->44769 44772 50b2b1e 44771->44772 44774 50b2b37 44772->44774 44801 50b2c58 44772->44801 44808 50b2c60 44772->44808 44773 50b2b60 44775 50b2c58 3 API calls 44773->44775 44776 50b2c60 3 API calls 44773->44776 44774->44758 44775->44774 44776->44774 44780 50b2a9f 44779->44780 44781 50b2b16 44779->44781 44780->44758 44783 50b2b37 44781->44783 44784 50b2c58 3 API calls 44781->44784 44785 50b2c60 3 API calls 44781->44785 44782 50b2b60 44786 50b2c58 3 API calls 44782->44786 44787 50b2c60 3 API calls 44782->44787 44783->44758 44784->44782 44785->44782 44786->44783 44787->44783 44789 50b1a2b 44788->44789 44793 50b28b8 44789->44793 44797 50b28c0 44789->44797 44790 50b1af9 44794 50b2913 CreateProcessAsUserW 44793->44794 44796 50b29a4 44794->44796 44796->44790 44798 50b2913 CreateProcessAsUserW 44797->44798 44800 50b29a4 44798->44800 44800->44790 44802 50b2c6d 44801->44802 44804 50b2ca4 44802->44804 44815 50b1d7c 44802->44815 44819 50a0580 44804->44819 44824 50a0573 44804->44824 44810 50b2c6d 44808->44810 44809 50b1d7c WaitNamedPipeW 44809->44810 44810->44809 44811 50b2ca4 44810->44811 44813 50a0573 2 API calls 44811->44813 44814 50a0580 2 API calls 44811->44814 44812 50b2caf 44812->44773 44813->44812 44814->44812 44816 50b2cc8 WaitNamedPipeW 44815->44816 44818 50b2d44 44816->44818 44818->44802 44820 50a0593 44819->44820 44829 50a05d0 44820->44829 44833 50a05c4 44820->44833 44825 50a0580 44824->44825 44827 50a05d0 CreateFileA 44825->44827 44828 50a05c4 CreateFileA 44825->44828 44826 50a05b8 44826->44773 44827->44826 44828->44826 44832 50a062e 44829->44832 44830 50a06a3 CreateFileA 44831 50a0705 44830->44831 44832->44830 44832->44832 44835 50a05cf 44833->44835 44834 50a06a3 CreateFileA 44836 50a0705 44834->44836 44835->44834 44835->44835

                                                                                                                                                              Executed Functions

                                                                                                                                                              Function 050B28C0 Relevance: 1.6, APIs: 1, Instructions: 93processCOMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 652 50b28c0-50b2911 653 50b291c-50b2920 652->653 654 50b2913-50b2919 652->654 655 50b2928-50b293d 653->655 656 50b2922-50b2925 653->656 654->653 657 50b294b-50b29a2 CreateProcessAsUserW 655->657 658 50b293f-50b2948 655->658 656->655 659 50b29ab-50b29d3 657->659 660 50b29a4-50b29aa 657->660 658->657 660->659
                                                                                                                                                              APIs
                                                                                                                                                              • CreateProcessAsUserW.KERNEL32(?,00000000,00000000,?,?,?,?,?,00000000,?,?), ref: 050B298F
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000007.00000002.3610057327.00000000050B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_7_2_50b0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: CreateProcessUser
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 2217836671-0
                                                                                                                                                              • Opcode ID: a748605f435e5834b0967fd7969a2c8a41ea9bd76ff680cc9d5797640254ce9d
                                                                                                                                                              • Instruction ID: d3fa76780ff531ce0f242b69b72888a32ead560c10398d3bed68590c0c93206c
                                                                                                                                                              • Opcode Fuzzy Hash: a748605f435e5834b0967fd7969a2c8a41ea9bd76ff680cc9d5797640254ce9d
                                                                                                                                                              • Instruction Fuzzy Hash: D641357690020ADFDF10CFA9D884ADEBBF1FF48310F14842AE958A7250D775A955CF90
                                                                                                                                                              Function 03790E88 Relevance: 1.6, APIs: 1, Instructions: 64encryptionCOMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              • CryptProtectData.CRYPT32(?,00000000,?,?,?,?,?), ref: 037916EE
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000007.00000002.3596738180.0000000003790000.00000040.00000800.00020000.00000000.sdmp, Offset: 03790000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_7_2_3790000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: CryptDataProtect
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 3091777813-0
                                                                                                                                                              • Opcode ID: 0f0e253ea04e4dd1fb06d1d8ffc13bf9d834580ae19cd6a696a336281c897434
                                                                                                                                                              • Instruction ID: 1153978612f90611cdc73629c4e3dd4bfcb16dcfb07b505dc7833a91ffa33103
                                                                                                                                                              • Opcode Fuzzy Hash: 0f0e253ea04e4dd1fb06d1d8ffc13bf9d834580ae19cd6a696a336281c897434
                                                                                                                                                              • Instruction Fuzzy Hash: FC2123B6C0024ADFDF10CF9AD844ADEBBF5FB88310F14852AE918A7211C739A555CFA1
                                                                                                                                                              Function 03791670 Relevance: 1.6, APIs: 1, Instructions: 63encryptionCOMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              • CryptProtectData.CRYPT32(?,00000000,?,?,?,?,?), ref: 037916EE
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000007.00000002.3596738180.0000000003790000.00000040.00000800.00020000.00000000.sdmp, Offset: 03790000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_7_2_3790000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: CryptDataProtect
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 3091777813-0
                                                                                                                                                              • Opcode ID: e0e1769ef232efa8cdb38a355a23ed62ea2e2f0dd60f69f8453c5762544b427a
                                                                                                                                                              • Instruction ID: cc99c14766e24be485a9e5e2f8f7d88e45214aefc475c5a9ec1fe8b31b5a58a6
                                                                                                                                                              • Opcode Fuzzy Hash: e0e1769ef232efa8cdb38a355a23ed62ea2e2f0dd60f69f8453c5762544b427a
                                                                                                                                                              • Instruction Fuzzy Hash: 7D2114B6C0024ADFDF10CF9AD844ADEBBF1FB88310F14852AE918A7210C735A555CFA1
                                                                                                                                                              Function 008C4C67 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 108COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 282 8c4c67-8c4cb3 287 8c4cb5-8c4cc4 call 8c4848 282->287 288 8c4d02-8c4d08 282->288 291 8c4d09-8c4dd8 RtlGetVersion 287->291 292 8c4cc6-8c4ccb 287->292 297 8c4dda-8c4de0 291->297 298 8c4de1-8c4e24 291->298 304 8c4cce call 8c52e8 292->304 305 8c4cce call 8c52f8 292->305 293 8c4cd4 293->288 297->298 302 8c4e2b-8c4e32 298->302 303 8c4e26 298->303 303->302 304->293 305->293
                                                                                                                                                              APIs
                                                                                                                                                              • RtlGetVersion.NTDLL(0000009C), ref: 008C4DBE
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000007.00000002.3577347426.00000000008C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008C0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_7_2_8c0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: Version
                                                                                                                                                              • String ID: `Q^q$`Q^q
                                                                                                                                                              • API String ID: 1889659487-4048626156
                                                                                                                                                              • Opcode ID: 644f209bcd8e833974ecc782bbe30ed8e1d6f36638ce51b3d624152373f2d723
                                                                                                                                                              • Instruction ID: c8d68625f1d7d0ec33406902e37bce6e3517abe3f5b7f6b26746c61d79164b8a
                                                                                                                                                              • Opcode Fuzzy Hash: 644f209bcd8e833974ecc782bbe30ed8e1d6f36638ce51b3d624152373f2d723
                                                                                                                                                              • Instruction Fuzzy Hash: D0418870A00218DFDB60EF68D818BA9BBB5FB45300F0084E9D50DA7291DB749E88CF92
                                                                                                                                                              Function 050A05C4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 119fileCOMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 418 50a05c4-50a05cd 419 50a05d8-50a062c 418->419 420 50a05cf-50a05d6 418->420 421 50a062e-50a0653 419->421 422 50a0680-50a0703 CreateFileA 419->422 420->419 421->422 425 50a0655-50a0657 421->425 429 50a070c-50a074a 422->429 430 50a0705-50a070b 422->430 427 50a067a-50a067d 425->427 428 50a0659-50a0663 425->428 427->422 431 50a0667-50a0676 428->431 432 50a0665 428->432 437 50a075a 429->437 438 50a074c-50a0750 429->438 430->429 431->431 433 50a0678 431->433 432->431 433->427 440 50a075b 437->440 438->437 439 50a0752 438->439 439->437 440->440
                                                                                                                                                              APIs
                                                                                                                                                              • CreateFileA.KERNEL32(?,?,?,?,?,00000001,00000004), ref: 050A06ED
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000007.00000002.3609936080.00000000050A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_7_2_50a0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: CreateFile
                                                                                                                                                              • String ID: 4L^q
                                                                                                                                                              • API String ID: 823142352-616035646
                                                                                                                                                              • Opcode ID: daa8803cc4c90786244cada1c020c1f6c6e275e9ae298122e6acaf48b4020703
                                                                                                                                                              • Instruction ID: d7df15ee9782ca4cbb4ee1446396ca62129e1187def7fef973e38d1456f866d9
                                                                                                                                                              • Opcode Fuzzy Hash: daa8803cc4c90786244cada1c020c1f6c6e275e9ae298122e6acaf48b4020703
                                                                                                                                                              • Instruction Fuzzy Hash: 135147B1D00249DFDB10CFA9D998B9EBBF2FB88304F248129E818AB355D7759845CF91
                                                                                                                                                              Function 050A05D0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 116fileCOMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 441 50a05d0-50a062c 442 50a062e-50a0653 441->442 443 50a0680-50a0703 CreateFileA 441->443 442->443 446 50a0655-50a0657 442->446 450 50a070c-50a074a 443->450 451 50a0705-50a070b 443->451 448 50a067a-50a067d 446->448 449 50a0659-50a0663 446->449 448->443 452 50a0667-50a0676 449->452 453 50a0665 449->453 458 50a075a 450->458 459 50a074c-50a0750 450->459 451->450 452->452 454 50a0678 452->454 453->452 454->448 461 50a075b 458->461 459->458 460 50a0752 459->460 460->458 461->461
                                                                                                                                                              APIs
                                                                                                                                                              • CreateFileA.KERNEL32(?,?,?,?,?,00000001,00000004), ref: 050A06ED
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000007.00000002.3609936080.00000000050A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_7_2_50a0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: CreateFile
                                                                                                                                                              • String ID: 4L^q
                                                                                                                                                              • API String ID: 823142352-616035646
                                                                                                                                                              • Opcode ID: 4c08d1056a7f197fb1706178a1a6b73708809fc5ed40d53ea124fef0d72184f6
                                                                                                                                                              • Instruction ID: a0355875e6535d06d36ebd9fa27e359325ffe502e70492bd1c5d4bda0f447b46
                                                                                                                                                              • Opcode Fuzzy Hash: 4c08d1056a7f197fb1706178a1a6b73708809fc5ed40d53ea124fef0d72184f6
                                                                                                                                                              • Instruction Fuzzy Hash: 234146B1D00248DFDB10CFA9D998B9EBBF2FB88704F148129E818AB355D7759845CF91
                                                                                                                                                              Function 050A2D50 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 91registryCOMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 462 50a2d50-50a2ddb 468 50a2dec-50a2e04 462->468 469 50a2ddd-50a2dea 462->469 470 50a2ec6-50a2ece 468->470 469->468 472 50a2e09-50a2e38 RegDisablePredefinedCache 469->472 476 50a2ecf 470->476 474 50a2e3a-50a2e40 472->474 475 50a2e41-50a2e5c call 50a2c18 472->475 474->475 480 50a2e61-50a2e7d 475->480 476->476 483 50a2e88 480->483 484 50a2e7f 480->484 483->470 484->483
                                                                                                                                                              APIs
                                                                                                                                                              • RegDisablePredefinedCache.ADVAPI32 ref: 050A2E21
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000007.00000002.3609936080.00000000050A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050A0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_7_2_50a0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: CacheDisablePredefined
                                                                                                                                                              • String ID: `Q^q
                                                                                                                                                              • API String ID: 1885667121-1948671464
                                                                                                                                                              • Opcode ID: 42957e9368ee78febf439df3164cef033ec530f8fcc8aa9cdb44e824cd78485d
                                                                                                                                                              • Instruction ID: 9135b1e843c62bb20d54ff88977a57a217835e7b6245459bc33ed36e6a1c67ab
                                                                                                                                                              • Opcode Fuzzy Hash: 42957e9368ee78febf439df3164cef033ec530f8fcc8aa9cdb44e824cd78485d
                                                                                                                                                              • Instruction Fuzzy Hash: 71314475E00209DFDB14DFA9E944B9EBBB2BF88310F148429E806AB351DBB45885CF91
                                                                                                                                                              Function 050B28B8 Relevance: 1.6, APIs: 1, Instructions: 93processCOMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 641 50b28b8-50b2911 642 50b291c-50b2920 641->642 643 50b2913-50b2919 641->643 644 50b2928-50b293d 642->644 645 50b2922-50b2925 642->645 643->642 646 50b294b-50b29a2 CreateProcessAsUserW 644->646 647 50b293f-50b2948 644->647 645->644 648 50b29ab-50b29d3 646->648 649 50b29a4-50b29aa 646->649 647->646 649->648
                                                                                                                                                              APIs
                                                                                                                                                              • CreateProcessAsUserW.KERNEL32(?,00000000,00000000,?,?,?,?,?,00000000,?,?), ref: 050B298F
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000007.00000002.3610057327.00000000050B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_7_2_50b0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: CreateProcessUser
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 2217836671-0
                                                                                                                                                              • Opcode ID: 56b0d11ebb80e631ba8a341530af9d47fe887c45de13023182debf4fe88fa81a
                                                                                                                                                              • Instruction ID: d7aec85433f7dd92688eefe0b664d7f631aecf17bd3f3d7ce3aed5a4152e4846
                                                                                                                                                              • Opcode Fuzzy Hash: 56b0d11ebb80e631ba8a341530af9d47fe887c45de13023182debf4fe88fa81a
                                                                                                                                                              • Instruction Fuzzy Hash: A741457690020ADFDF11CFA9D884ADEBBF1FF48320F04842AE958A7250D374A955CF90
                                                                                                                                                              Function 050B1465 Relevance: 1.6, APIs: 1, Instructions: 66pipeCOMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              • ConnectNamedPipe.KERNEL32(00000000), ref: 050B14E8
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000007.00000002.3610057327.00000000050B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_7_2_50b0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: ConnectNamedPipe
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 2191148154-0
                                                                                                                                                              • Opcode ID: a18279c2b6fe63a48a12e092bfb71b25fa15a5f61c7ed92287412483b181a033
                                                                                                                                                              • Instruction ID: 1491629e1c213db0b195f4fea5e6de23d9f8e8a4f0cc5f75f3d85a62dff2712d
                                                                                                                                                              • Opcode Fuzzy Hash: a18279c2b6fe63a48a12e092bfb71b25fa15a5f61c7ed92287412483b181a033
                                                                                                                                                              • Instruction Fuzzy Hash: F12112B1D00218DFDB14CF99D594BDEBBF1AF08304F148059E819AB350DB749A45CFA4
                                                                                                                                                              Function 050B1470 Relevance: 1.6, APIs: 1, Instructions: 65pipeCOMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              • ConnectNamedPipe.KERNEL32(00000000), ref: 050B14E8
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000007.00000002.3610057327.00000000050B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_7_2_50b0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: ConnectNamedPipe
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 2191148154-0
                                                                                                                                                              • Opcode ID: 90badaf763f83d38ac44b60b2900af3b8eeb77d3ce77a744210ed2bf49846dd2
                                                                                                                                                              • Instruction ID: 84bf386588f2c39824e9343a130a05ddaa1fc724dc4efe2eaa5f42e2f0cb48e6
                                                                                                                                                              • Opcode Fuzzy Hash: 90badaf763f83d38ac44b60b2900af3b8eeb77d3ce77a744210ed2bf49846dd2
                                                                                                                                                              • Instruction Fuzzy Hash: A02113B0D00258DFDB24CFAAD494BDEBBF5AF48304F148069E859AB350CBB49945CFA5
                                                                                                                                                              Function 050B1D7C Relevance: 1.6, APIs: 1, Instructions: 59pipeCOMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              • WaitNamedPipeW.KERNEL32(00000000,0000000A,?,?,?,?,?,?,?,050B2C86), ref: 050B2D2F
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000007.00000002.3610057327.00000000050B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_7_2_50b0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: NamedPipeWait
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 3146367894-0
                                                                                                                                                              • Opcode ID: 64fb65171ae8002a70435857351fc0b1f78ee618d2f55377a4dce920c611786c
                                                                                                                                                              • Instruction ID: 4f0a1f55335611ed77a119953fea260a6dd116bd0c0ad4a6d763df8a3202a6c8
                                                                                                                                                              • Opcode Fuzzy Hash: 64fb65171ae8002a70435857351fc0b1f78ee618d2f55377a4dce920c611786c
                                                                                                                                                              • Instruction Fuzzy Hash: 1B2127B580060A8FDB10DF9AD444AEEBBF4EB48310F14842DD859A7341C779A945CFA5
                                                                                                                                                              Function 050B2CC0 Relevance: 1.6, APIs: 1, Instructions: 56pipeCOMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              • WaitNamedPipeW.KERNEL32(00000000,0000000A,?,?,?,?,?,?,?,050B2C86), ref: 050B2D2F
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000007.00000002.3610057327.00000000050B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050B0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_7_2_50b0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: NamedPipeWait
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 3146367894-0
                                                                                                                                                              • Opcode ID: 8cbac00e3cc0cd0a9a7463d9a4fe7dc8a61f3d332b8ffea21d71d09c517152f9
                                                                                                                                                              • Instruction ID: 9e4960b32d4d5f9c5744789c8eaa794c1b6fed689376c760c58a5d91e747bb44
                                                                                                                                                              • Opcode Fuzzy Hash: 8cbac00e3cc0cd0a9a7463d9a4fe7dc8a61f3d332b8ffea21d71d09c517152f9
                                                                                                                                                              • Instruction Fuzzy Hash: B62113B6C0020A8FDB10CF99D5847EEBBF4AB48320F14842ED869B7241C378A545CFA1
                                                                                                                                                              Function 0086D670 Relevance: .1, Instructions: 75COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000007.00000002.3576913179.000000000086D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0086D000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_7_2_86d000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: f0be44dbb6218d74f0c1ee5a78e1778ae9ff7317018fcf819152088c1e9619ee
                                                                                                                                                              • Instruction ID: 57d2f3ad152fc7b145548107087131d80605a7e50551f5e738fd05dd98697a13
                                                                                                                                                              • Opcode Fuzzy Hash: f0be44dbb6218d74f0c1ee5a78e1778ae9ff7317018fcf819152088c1e9619ee
                                                                                                                                                              • Instruction Fuzzy Hash: 8F2137B1A04344DFCB15DF14D9C0B27BFA5FBA8314F25C169E8098B256C336D856CBA2
                                                                                                                                                              Function 0086D66B Relevance: .1, Instructions: 56COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000007.00000002.3576913179.000000000086D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0086D000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_7_2_86d000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
                                                                                                                                                              • Instruction ID: 9f6870afe7a25dd9c31707889c0c7acb01b7fe5a5700dead103e946e348a477f
                                                                                                                                                              • Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
                                                                                                                                                              • Instruction Fuzzy Hash: BF11D376904380CFCB16CF10D9C4B16BF72FB98324F24C6A9D8094B256C336D85ACBA2
                                                                                                                                                              Function 0086D01D Relevance: .0, Instructions: 45COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000007.00000002.3576913179.000000000086D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0086D000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_7_2_86d000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 9d68198d0c28a83c0620674c915ecf71692058d4016df29ca4262de915ae6350
                                                                                                                                                              • Instruction ID: 0138c086d9e5698eaf7530b49d8f96a65d7afda4b6a41d66a890d0fe5c8919db
                                                                                                                                                              • Opcode Fuzzy Hash: 9d68198d0c28a83c0620674c915ecf71692058d4016df29ca4262de915ae6350
                                                                                                                                                              • Instruction Fuzzy Hash: 52012B71A087449EE7108A25CD84B67FFD8FF41324F18C42AED088F186C279D845C6B3
                                                                                                                                                              Function 0086D01C Relevance: .0, Instructions: 36COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000007.00000002.3576913179.000000000086D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0086D000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_7_2_86d000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: e1381db8e71f45a096a2fc726e83c396ee1dcad8a13f06d4ad7bef4abf1dea7e
                                                                                                                                                              • Instruction ID: 3da8a37f1050a1b3201f9202f19da01fe16f0e8ab994bba7523410d737c76b04
                                                                                                                                                              • Opcode Fuzzy Hash: e1381db8e71f45a096a2fc726e83c396ee1dcad8a13f06d4ad7bef4abf1dea7e
                                                                                                                                                              • Instruction Fuzzy Hash: ADF06271509744AEEB108A16C884B62FFE8FB51724F18C55AED485E286C2799845CAB1

                                                                                                                                                              Non-executed Functions

                                                                                                                                                              Function 03923684 Relevance: .1, Instructions: 63COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000007.00000002.3598309637.0000000003922000.00000002.00000001.01000000.0000000F.sdmp, Offset: 03920000, based on PE: true
                                                                                                                                                              • Associated: 00000007.00000002.3598256082.0000000003920000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003969000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.000000000396B000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003979000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.000000000398A000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.000000000398C000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.000000000398E000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003990000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003992000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003994000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003997000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039A7000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039A9000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039AB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039AD000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039AF000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039B7000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039CA000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039CC000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039DD000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039EE000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039F1000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039FE000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A0A000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A1B000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A2C000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A2F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A36000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A47000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A4E000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A53000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A55000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A57000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A59000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A63000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A71000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A80000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A91000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003AA2000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003AB3000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003AC4000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_7_2_3920000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: fa0bf766ce273a47b230c27f1784a0aae6f0572a44361247dba46a5cdbc47c70
                                                                                                                                                              • Instruction ID: 1d207ddebf96d0f0305b9bc7b731c7cbe3641797742b37bcc0a9d911d4eb18bf
                                                                                                                                                              • Opcode Fuzzy Hash: fa0bf766ce273a47b230c27f1784a0aae6f0572a44361247dba46a5cdbc47c70
                                                                                                                                                              • Instruction Fuzzy Hash: 1611455510EBC28FD703AB785EB90D4BF75AE5320434E49C7C0C48E0A7E6190A5ACB76
                                                                                                                                                              Function 0372AFD2 Relevance: .1, Instructions: 59COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000007.00000002.3595080744.0000000003721000.00000002.00000001.01000000.0000000E.sdmp, Offset: 036E0000, based on PE: true
                                                                                                                                                              • Associated: 00000007.00000002.3594812208.00000000036E0000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3595080744.0000000003710000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3595080744.0000000003732000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3595080744.0000000003734000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3595080744.0000000003736000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3595080744.0000000003738000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3595080744.000000000373A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3595080744.000000000374B000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3595080744.0000000003751000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3595080744.0000000003753000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3595080744.0000000003755000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3595080744.0000000003757000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3595080744.0000000003759000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_7_2_36e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: e1dcd68c5bd71f2a632957fee145948f37fe1b9f0655338d8a89d88957165b51
                                                                                                                                                              • Instruction ID: 9449cceeded4c4cd0f8bf7b6c270bcd3b6976e0963e3cc65750ede8df7c0b5f4
                                                                                                                                                              • Opcode Fuzzy Hash: e1dcd68c5bd71f2a632957fee145948f37fe1b9f0655338d8a89d88957165b51
                                                                                                                                                              • Instruction Fuzzy Hash: BB219D3464E292DFC3168B248C514D67BB1FF4730876D82FED0984B963E2260547C791
                                                                                                                                                              Function 03AB3FF7 Relevance: .0, Instructions: 23COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000007.00000002.3598309637.0000000003AB3000.00000002.00000001.01000000.0000000F.sdmp, Offset: 03920000, based on PE: true
                                                                                                                                                              • Associated: 00000007.00000002.3598256082.0000000003920000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003922000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003969000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.000000000396B000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003979000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.000000000398A000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.000000000398C000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.000000000398E000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003990000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003992000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003994000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003997000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039A7000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039A9000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039AB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039AD000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039AF000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039B7000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039CA000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039CC000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039DD000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039EE000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039F1000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039FE000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A0A000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A1B000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A2C000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A2F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A36000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A47000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A4E000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A53000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A55000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A57000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A59000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A63000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A71000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A80000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A91000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003AA2000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003AC4000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_7_2_3920000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 92e08cc1781909cd972903b5f8f632cf9dc1aa5494cba561f31d9f8a5f59e576
                                                                                                                                                              • Instruction ID: ab65e9044f46208b33ae33e18cbbb9f86018a60471d1d904a39c6bccc7ca98c0
                                                                                                                                                              • Opcode Fuzzy Hash: 92e08cc1781909cd972903b5f8f632cf9dc1aa5494cba561f31d9f8a5f59e576
                                                                                                                                                              • Instruction Fuzzy Hash: FEE04632921268EBC724DB999A4499AF3BCEB0AA11B15019BF904D3242C6749E00C7D0
                                                                                                                                                              Function 03AB1334 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              • _ValidateLocalCookies.LIBCMT ref: 03AB135F
                                                                                                                                                              • ___except_validate_context_record.LIBVCRUNTIME ref: 03AB1367
                                                                                                                                                              • _ValidateLocalCookies.LIBCMT ref: 03AB13F5
                                                                                                                                                              • __IsNonwritableInCurrentImage.LIBCMT ref: 03AB1420
                                                                                                                                                              • _ValidateLocalCookies.LIBCMT ref: 03AB1475
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000007.00000002.3598309637.0000000003AA2000.00000002.00000001.01000000.0000000F.sdmp, Offset: 03920000, based on PE: true
                                                                                                                                                              • Associated: 00000007.00000002.3598256082.0000000003920000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003922000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003969000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.000000000396B000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003979000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.000000000398A000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.000000000398C000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.000000000398E000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003990000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003992000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003994000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003997000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039A7000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039A9000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039AB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039AD000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039AF000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039B7000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039CA000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039CC000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039DD000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039EE000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039F1000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039FE000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A0A000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A1B000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A2C000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A2F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A36000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A47000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A4E000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A53000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A55000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A57000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A59000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A63000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A71000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A80000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A91000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003AB3000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003AC4000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_7_2_3920000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                                                                                              • String ID: csm
                                                                                                                                                              • API String ID: 1170836740-1018135373
                                                                                                                                                              • Opcode ID: 0b8ec5638f32be2a31b5bda28eb0342a6ecb616dc31b2cd8e73ff41f3f0039e3
                                                                                                                                                              • Instruction ID: 3e1e97017151ba39abc61119ffc53281b6366920d8583cc08b976affe604240f
                                                                                                                                                              • Opcode Fuzzy Hash: 0b8ec5638f32be2a31b5bda28eb0342a6ecb616dc31b2cd8e73ff41f3f0039e3
                                                                                                                                                              • Instruction Fuzzy Hash: 7E41C434A002089BCF10DF69C894ADEBBB9AF45314F18806AE8159F753D731D915CFA1
                                                                                                                                                              Function 03730647 Relevance: 6.5, Strings: 5, Instructions: 207COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000007.00000002.3595080744.0000000003721000.00000002.00000001.01000000.0000000E.sdmp, Offset: 036E0000, based on PE: true
                                                                                                                                                              • Associated: 00000007.00000002.3594812208.00000000036E0000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3595080744.0000000003710000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3595080744.0000000003732000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3595080744.0000000003734000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3595080744.0000000003736000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3595080744.0000000003738000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3595080744.000000000373A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3595080744.000000000374B000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3595080744.0000000003751000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3595080744.0000000003753000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3595080744.0000000003755000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3595080744.0000000003757000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3595080744.0000000003759000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_7_2_36e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: w!6$w@6$w`6$ws7$w6
                                                                                                                                                              • API String ID: 0-1793719296
                                                                                                                                                              • Opcode ID: f52537b65619fa56a581e52add94d6acd9c05e858a0b9be149b7e105e3ecbfcf
                                                                                                                                                              • Instruction ID: 4567b150908712da4e6253c9415ca27c2f8fe6e3f1f15e74268ca7f34fe52b37
                                                                                                                                                              • Opcode Fuzzy Hash: f52537b65619fa56a581e52add94d6acd9c05e858a0b9be149b7e105e3ecbfcf
                                                                                                                                                              • Instruction Fuzzy Hash: EC71AE6608D3C54FE7078B2068E51E47F66AF136B0B9D80DBCC848E49BD35B598EC762
                                                                                                                                                              Function 03AB188A Relevance: 6.1, APIs: 4, Instructions: 60COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              APIs
                                                                                                                                                              • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 03AB18A6
                                                                                                                                                              • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 03AB18BF
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000007.00000002.3598309637.0000000003AA2000.00000002.00000001.01000000.0000000F.sdmp, Offset: 03920000, based on PE: true
                                                                                                                                                              • Associated: 00000007.00000002.3598256082.0000000003920000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003922000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003969000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.000000000396B000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003979000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.000000000398A000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.000000000398C000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.000000000398E000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003990000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003992000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003994000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003997000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039A7000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039A9000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039AB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039AD000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039AF000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039B5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039B7000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039CA000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039CC000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039DD000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039EE000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039F1000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.00000000039FE000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A0A000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A1B000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A2C000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A2F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A34000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A36000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A47000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A4E000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A53000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A55000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A57000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A59000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A63000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A71000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A80000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003A91000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003AB3000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              • Associated: 00000007.00000002.3598309637.0000000003AC4000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_7_2_3920000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: Value___vcrt_
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 1426506684-0
                                                                                                                                                              • Opcode ID: bcea462541d5702a1058987f6d616999ec3f08688881a83fdccaf600ec120df0
                                                                                                                                                              • Instruction ID: c8535e23a5d641a1b7d2f1dce94fbb4bee4d8c9cd7058ebb83aad6fc12aab189
                                                                                                                                                              • Opcode Fuzzy Hash: bcea462541d5702a1058987f6d616999ec3f08688881a83fdccaf600ec120df0
                                                                                                                                                              • Instruction Fuzzy Hash: 1E01F5376083215DF62897B55DE8AEA27BCFB02371724066FF110892F3FE5248115184

                                                                                                                                                              Execution Graph

                                                                                                                                                              Execution Coverage:10.1%
                                                                                                                                                              Dynamic/Decrypted Code Coverage:100%
                                                                                                                                                              Signature Coverage:27.3%
                                                                                                                                                              Total number of Nodes:11
                                                                                                                                                              Total number of Limit Nodes:1
                                                                                                                                                              execution_graph 19446 7ffd9b3d3662 19447 7ffd9b3f5dd0 ConnectNamedPipe 19446->19447 19449 7ffd9b3f5e82 19447->19449 19450 7ffd9b3d3642 19451 7ffd9b3f5860 CreateNamedPipeW 19450->19451 19453 7ffd9b3f5993 19451->19453 19454 7ffd9b3d8014 19456 7ffd9b3d801d 19454->19456 19455 7ffd9b3d8082 19456->19455 19457 7ffd9b3d80f6 SetProcessMitigationPolicy 19456->19457 19458 7ffd9b3d8152 19457->19458

                                                                                                                                                              Executed Functions

                                                                                                                                                              Function 00007FFD9B6E951B Relevance: 2.1, Instructions: 2101COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 106499f50262366b2d0722206caf08c9aca7570cc5a04a264336802caa5f2ced
                                                                                                                                                              • Instruction ID: 2966968dc859bf0ee7e700fe366b2f18cd4111bd5ba0d056b643df2e88eada25
                                                                                                                                                              • Opcode Fuzzy Hash: 106499f50262366b2d0722206caf08c9aca7570cc5a04a264336802caa5f2ced
                                                                                                                                                              • Instruction Fuzzy Hash: 5D034D30A0961D8FDBA9DB68C8A4BA877F1EF58300F5541F9D41DDB2A1DE35AE81CB40
                                                                                                                                                              Function 00007FFD9B6E76FA Relevance: 2.1, Strings: 1, Instructions: 814COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 577 7ffd9b6e76fa-7ffd9b6e770e 579 7ffd9b6e7710-7ffd9b6e772a 577->579 582 7ffd9b6e772c-7ffd9b6e773a 579->582 583 7ffd9b6e76c7-7ffd9b6e76d1 579->583 586 7ffd9b6e773c-7ffd9b6e773d 582->586 587 7ffd9b6e76d7-7ffd9b6e76d9 582->587 590 7ffd9b6e76a8-7ffd9b6e76c6 583->590 588 7ffd9b6e773f-7ffd9b6e7741 586->588 589 7ffd9b6e76db-7ffd9b6e76e6 587->589 587->590 588->579 592 7ffd9b6e7743-7ffd9b6e775e 588->592 596 7ffd9b6e76ed-7ffd9b6e76f0 589->596 590->583 600 7ffd9b6e775f-7ffd9b6e776e 592->600 596->596 598 7ffd9b6e76f2-7ffd9b6e76f9 596->598 604 7ffd9b6e776f-7ffd9b6e7786 600->604 607 7ffd9b6e7787-7ffd9b6e77a0 604->607 610 7ffd9b6e77b5 607->610 611 7ffd9b6e77a2 607->611 613 7ffd9b6e77b6 610->613 614 7ffd9b6e77b7-7ffd9b6e77c2 610->614 611->588 612 7ffd9b6e77a4-7ffd9b6e77b0 611->612 612->610 613->614 614->600 617 7ffd9b6e77c4-7ffd9b6e77d2 614->617 617->604 619 7ffd9b6e77d4-7ffd9b6e77ea 617->619 619->607 621 7ffd9b6e77ec-7ffd9b6e77fc 619->621 623 7ffd9b6e7846-7ffd9b6e7856 621->623 624 7ffd9b6e77fe-7ffd9b6e781a 621->624 632 7ffd9b6e785c-7ffd9b6e786a call 7ffd9b6e0078 623->632 633 7ffd9b6e7858-7ffd9b6e785a 623->633 625 7ffd9b6e7c28-7ffd9b6e7c46 call 7ffd9b6e0c30 * 2 624->625 626 7ffd9b6e7820-7ffd9b6e783e call 7ffd9b6e0c30 * 2 624->626 644 7ffd9b6e7c4c-7ffd9b6e7c53 625->644 645 7ffd9b6e7d52-7ffd9b6e7d5d 625->645 642 7ffd9b6e7844-7ffd9b6e7845 626->642 643 7ffd9b6e7abe-7ffd9b6e7adc call 7ffd9b6e0c30 * 2 626->643 636 7ffd9b6e786d-7ffd9b6e7882 632->636 633->636 646 7ffd9b6e7888-7ffd9b6e78ac call 7ffd9b6e74e0 * 2 636->646 647 7ffd9b6e7884-7ffd9b6e7886 636->647 642->623 666 7ffd9b6e7b06-7ffd9b6e7b24 call 7ffd9b6e0c30 * 2 643->666 667 7ffd9b6e7ade-7ffd9b6e7ae8 643->667 649 7ffd9b6e7c66-7ffd9b6e7c68 644->649 650 7ffd9b6e7c55-7ffd9b6e7c64 644->650 652 7ffd9b6e78af-7ffd9b6e78c4 646->652 647->652 651 7ffd9b6e7c6f-7ffd9b6e7c93 649->651 650->649 658 7ffd9b6e7c6a 650->658 663 7ffd9b6e7c95-7ffd9b6e7cb2 651->663 664 7ffd9b6e7cdf-7ffd9b6e7ced 651->664 668 7ffd9b6e78ca-7ffd9b6e78ee call 7ffd9b6e74e0 * 2 652->668 669 7ffd9b6e78c6-7ffd9b6e78c8 652->669 658->651 678 7ffd9b6e7cb8-7ffd9b6e7cdd 663->678 679 7ffd9b6e7d5e-7ffd9b6e7dd7 663->679 664->645 695 7ffd9b6e7b2a-7ffd9b6e7b35 666->695 696 7ffd9b6e7bdb-7ffd9b6e7be6 666->696 672 7ffd9b6e7aea-7ffd9b6e7afa 667->672 673 7ffd9b6e7afc 667->673 674 7ffd9b6e78f1-7ffd9b6e7906 668->674 669->674 681 7ffd9b6e7afe-7ffd9b6e7aff 672->681 673->681 688 7ffd9b6e790c-7ffd9b6e7930 call 7ffd9b6e74e0 674->688 689 7ffd9b6e7908-7ffd9b6e790a 674->689 678->664 700 7ffd9b6e7dd9-7ffd9b6e7e1d 679->700 701 7ffd9b6e7e20-7ffd9b6e7e76 679->701 681->666 693 7ffd9b6e7933-7ffd9b6e7941 688->693 689->693 708 7ffd9b6e7947-7ffd9b6e7955 call 7ffd9b6e0078 693->708 709 7ffd9b6e7943-7ffd9b6e7945 693->709 706 7ffd9b6e7b3b-7ffd9b6e7b4a call 7ffd9b6e0078 695->706 707 7ffd9b6e7b37-7ffd9b6e7b39 695->707 710 7ffd9b6e7bec-7ffd9b6e7bfb call 7ffd9b6e0078 696->710 711 7ffd9b6e7be8-7ffd9b6e7bea 696->711 756 7ffd9b6e7e1e 700->756 734 7ffd9b6e7e7c-7ffd9b6e7ea0 701->734 735 7ffd9b6e7e78-7ffd9b6e7e79 701->735 715 7ffd9b6e7b4d-7ffd9b6e7b81 706->715 707->715 717 7ffd9b6e7958-7ffd9b6e7961 708->717 709->717 719 7ffd9b6e7bfe-7ffd9b6e7c00 710->719 711->719 715->696 730 7ffd9b6e7b83-7ffd9b6e7b91 715->730 740 7ffd9b6e7968-7ffd9b6e796f 717->740 719->645 721 7ffd9b6e7c06-7ffd9b6e7c27 719->721 731 7ffd9b6e7ba4-7ffd9b6e7bac 730->731 732 7ffd9b6e7b93-7ffd9b6e7b9b 730->732 737 7ffd9b6e7bad-7ffd9b6e7bae 731->737 739 7ffd9b6e7bbe-7ffd9b6e7bd1 731->739 732->737 738 7ffd9b6e7b9d-7ffd9b6e7ba2 732->738 754 7ffd9b6e7ed2-7ffd9b6e7edb 734->754 755 7ffd9b6e7ea2-7ffd9b6e7eb1 734->755 735->734 742 7ffd9b6e7bb3-7ffd9b6e7bbd call 7ffd9b6e7518 737->742 738->742 739->696 740->643 743 7ffd9b6e7975-7ffd9b6e797c 740->743 742->739 743->643 748 7ffd9b6e7982-7ffd9b6e7999 743->748 760 7ffd9b6e799b-7ffd9b6e79ad 748->760 761 7ffd9b6e79ce-7ffd9b6e79d9 748->761 758 7ffd9b6e7eb7-7ffd9b6e7ed1 755->758 759 7ffd9b6e7eb3-7ffd9b6e7eb4 755->759 756->756 759->758 768 7ffd9b6e79b3-7ffd9b6e79c1 call 7ffd9b6e0078 760->768 769 7ffd9b6e79af-7ffd9b6e79b1 760->769 766 7ffd9b6e79db-7ffd9b6e79dd 761->766 767 7ffd9b6e79df-7ffd9b6e79ee call 7ffd9b6e0078 761->767 770 7ffd9b6e79f1-7ffd9b6e79f3 766->770 767->770 772 7ffd9b6e79c4-7ffd9b6e79c7 768->772 769->772 775 7ffd9b6e79f9-7ffd9b6e7a10 770->775 776 7ffd9b6e7aa8-7ffd9b6e7aba 770->776 772->761 775->776 780 7ffd9b6e7a16-7ffd9b6e7a33 775->780 776->643 783 7ffd9b6e7a35-7ffd9b6e7a3d 780->783 784 7ffd9b6e7a3f 780->784 785 7ffd9b6e7a41-7ffd9b6e7a43 783->785 784->785 785->776 787 7ffd9b6e7a45-7ffd9b6e7a4f 785->787 788 7ffd9b6e7a51-7ffd9b6e7a5b call 7ffd9b6e46a8 787->788 789 7ffd9b6e7a5d-7ffd9b6e7a65 787->789 788->643 788->789 791 7ffd9b6e7a67-7ffd9b6e7a8c call 7ffd9b6e5d28 789->791 792 7ffd9b6e7a93-7ffd9b6e7aa6 call 7ffd9b6e7508 789->792 791->792 792->643
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: U#_H
                                                                                                                                                              • API String ID: 0-2729988108
                                                                                                                                                              • Opcode ID: 09ecefdde87846cc20993aeb79cb3bea04f97cee635cb5781a1af76ef65a4808
                                                                                                                                                              • Instruction ID: f11d426763b62a1fdf8c156dd95e63cdb208e16b67b0820f2d8d14cac25c6f8b
                                                                                                                                                              • Opcode Fuzzy Hash: 09ecefdde87846cc20993aeb79cb3bea04f97cee635cb5781a1af76ef65a4808
                                                                                                                                                              • Instruction Fuzzy Hash: 49322522B1EA4E0FE765E7A894796F937D2EF94300F16017AD06DCB1F2DD297A168340
                                                                                                                                                              Function 00007FFD9B3D3642 Relevance: 1.7, APIs: 1, Instructions: 172pipeCOMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 1076 7ffd9b3d3642-7ffd9b3f58ca 1079 7ffd9b3f58cc-7ffd9b3f58d1 1076->1079 1080 7ffd9b3f58d4-7ffd9b3f5991 CreateNamedPipeW 1076->1080 1079->1080 1082 7ffd9b3f5999-7ffd9b3f59cc 1080->1082 1083 7ffd9b3f5993 1080->1083 1083->1082
                                                                                                                                                              APIs
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3612137154.00007FFD9B3D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B3D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b3d0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: CreateNamedPipe
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 2489174969-0
                                                                                                                                                              • Opcode ID: 16635def49befe32d67fb9ba51d50d488ddd3a6f00b9dc94522c6e1d113279a4
                                                                                                                                                              • Instruction ID: bae107587e300723f6ac067ba3966f97e54ba18a2f34ca6cb7f1a871648df64d
                                                                                                                                                              • Opcode Fuzzy Hash: 16635def49befe32d67fb9ba51d50d488ddd3a6f00b9dc94522c6e1d113279a4
                                                                                                                                                              • Instruction Fuzzy Hash: 1B51A071A1CA1C9FDB68EF5C9805BE9BBE0FB59310F0442AEE04DD3251CB70A9418BC1
                                                                                                                                                              Function 00007FFD9B6E000A Relevance: 1.4, Instructions: 1384COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 1389 7ffd9b6e000a-7ffd9b6e0141 1407 7ffd9b6e0186-7ffd9b6e01d0 1389->1407 1408 7ffd9b6e0143-7ffd9b6e0185 1389->1408 1419 7ffd9b6e0212-7ffd9b6e021c 1407->1419 1420 7ffd9b6e01d2-7ffd9b6e01d9 1407->1420 1408->1407 1423 7ffd9b6e021d-7ffd9b6e51e6 1419->1423 1420->1423 1424 7ffd9b6e01db-7ffd9b6e01f0 1420->1424 1427 7ffd9b6e51e9-7ffd9b6e5217 1423->1427 1434 7ffd9b6e01f2-7ffd9b6e01f9 1424->1434 1435 7ffd9b6e0233-7ffd9b6e03d9 1424->1435 1430 7ffd9b6e521a-7ffd9b6e5246 1427->1430 1432 7ffd9b6e5248-7ffd9b6e5269 1430->1432 1433 7ffd9b6e5271-7ffd9b6e52a4 1430->1433 1432->1433 1437 7ffd9b6e52aa-7ffd9b6e52b9 1433->1437 1438 7ffd9b6e53e4-7ffd9b6e5413 1433->1438 1499 7ffd9b6e041b-7ffd9b6e0441 1435->1499 1500 7ffd9b6e03db-7ffd9b6e03f9 1435->1500 1446 7ffd9b6e52c4-7ffd9b6e52c6 1437->1446 1440 7ffd9b6e5415-7ffd9b6e541f call 7ffd9b6e46a8 1438->1440 1441 7ffd9b6e5464-7ffd9b6e5478 1438->1441 1440->1441 1451 7ffd9b6e5421-7ffd9b6e5433 1440->1451 1444 7ffd9b6e547a-7ffd9b6e5484 1441->1444 1445 7ffd9b6e54a8-7ffd9b6e54b3 1441->1445 1444->1445 1449 7ffd9b6e5486-7ffd9b6e5497 1444->1449 1446->1438 1450 7ffd9b6e52cc-7ffd9b6e5386 1446->1450 1449->1445 1458 7ffd9b6e5499-7ffd9b6e54a1 1449->1458 1450->1438 1479 7ffd9b6e5388-7ffd9b6e5398 1450->1479 1451->1441 1453 7ffd9b6e5435-7ffd9b6e545f call 7ffd9b6e4938 1451->1453 1453->1441 1458->1445 1479->1438 1481 7ffd9b6e539a-7ffd9b6e53df call 7ffd9b6e4928 1479->1481 1481->1438 1506 7ffd9b6e0483-7ffd9b6e048e 1499->1506 1507 7ffd9b6e0443-7ffd9b6e0482 1499->1507 1509 7ffd9b6e04d8-7ffd9b6e0500 1506->1509 1510 7ffd9b6e0490-7ffd9b6e04c6 1506->1510 1507->1506 1518 7ffd9b6e0502-7ffd9b6e0521 1509->1518 1519 7ffd9b6e0524-7ffd9b6e053c 1509->1519 1518->1519 1524 7ffd9b6e053e-7ffd9b6e055d 1519->1524 1525 7ffd9b6e0560-7ffd9b6e057e 1519->1525 1524->1525 1528 7ffd9b6e059a 1525->1528 1529 7ffd9b6e0580-7ffd9b6e0590 1525->1529 1531 7ffd9b6e059f-7ffd9b6e05a5 1528->1531 1532 7ffd9b6e0597-7ffd9b6e0598 1529->1532 1533 7ffd9b6e05ab-7ffd9b6e05b4 1531->1533 1534 7ffd9b6e063e-7ffd9b6e0641 1531->1534 1532->1528 1535 7ffd9b6e05b6-7ffd9b6e05c3 1533->1535 1536 7ffd9b6e05cd-7ffd9b6e05d8 1533->1536 1537 7ffd9b6e0698-7ffd9b6e06b6 1534->1537 1538 7ffd9b6e0643-7ffd9b6e064d 1534->1538 1535->1536 1544 7ffd9b6e05c5-7ffd9b6e05cb 1535->1544 1540 7ffd9b6e05da-7ffd9b6e05f7 1536->1540 1541 7ffd9b6e0624-7ffd9b6e063c 1536->1541 1555 7ffd9b6e06ba-7ffd9b6e06c6 1537->1555 1556 7ffd9b6e0800-7ffd9b6e081e 1537->1556 1545 7ffd9b6e0655-7ffd9b6e066e 1538->1545 1547 7ffd9b6e08e2-7ffd9b6e093f 1540->1547 1548 7ffd9b6e05fd-7ffd9b6e0622 1540->1548 1541->1534 1544->1536 1557 7ffd9b6e0670-7ffd9b6e0672 1545->1557 1558 7ffd9b6e06df-7ffd9b6e06ea 1545->1558 1586 7ffd9b6e094b-7ffd9b6e0952 1547->1586 1587 7ffd9b6e0941-7ffd9b6e094a 1547->1587 1548->1541 1564 7ffd9b6e06cc-7ffd9b6e06da call 7ffd9b6e0078 1555->1564 1565 7ffd9b6e06c8-7ffd9b6e06ca 1555->1565 1588 7ffd9b6e0824-7ffd9b6e082e 1556->1588 1589 7ffd9b6e08bd-7ffd9b6e08df 1556->1589 1559 7ffd9b6e0674 1557->1559 1560 7ffd9b6e06ee-7ffd9b6e06fa 1557->1560 1562 7ffd9b6e06eb-7ffd9b6e06ec 1558->1562 1559->1555 1566 7ffd9b6e0676-7ffd9b6e067a 1559->1566 1567 7ffd9b6e06fc-7ffd9b6e06fe 1560->1567 1568 7ffd9b6e0700-7ffd9b6e0701 1560->1568 1562->1560 1571 7ffd9b6e06dd-7ffd9b6e06de 1564->1571 1565->1571 1566->1562 1573 7ffd9b6e067c-7ffd9b6e0681 1566->1573 1575 7ffd9b6e0711-7ffd9b6e0715 1567->1575 1576 7ffd9b6e0702-7ffd9b6e070e call 7ffd9b6e0078 1568->1576 1571->1558 1573->1576 1578 7ffd9b6e0683-7ffd9b6e068e 1573->1578 1580 7ffd9b6e0716-7ffd9b6e072e 1575->1580 1576->1575 1583 7ffd9b6e0690-7ffd9b6e0695 1578->1583 1584 7ffd9b6e06ff 1578->1584 1600 7ffd9b6e0734-7ffd9b6e0742 call 7ffd9b6e0078 1580->1600 1601 7ffd9b6e0730-7ffd9b6e0732 1580->1601 1583->1580 1594 7ffd9b6e0697 1583->1594 1584->1568 1590 7ffd9b6e0954-7ffd9b6e095d 1586->1590 1591 7ffd9b6e095e-7ffd9b6e0969 1586->1591 1592 7ffd9b6e0834-7ffd9b6e0842 call 7ffd9b6e0078 1588->1592 1593 7ffd9b6e0830-7ffd9b6e0832 1588->1593 1589->1547 1597 7ffd9b6e0845-7ffd9b6e0862 1592->1597 1593->1597 1594->1537 1608 7ffd9b6e0868-7ffd9b6e0876 call 7ffd9b6e0078 1597->1608 1609 7ffd9b6e0864-7ffd9b6e0866 1597->1609 1602 7ffd9b6e0745-7ffd9b6e0762 1600->1602 1601->1602 1610 7ffd9b6e0768-7ffd9b6e0776 call 7ffd9b6e0078 1602->1610 1611 7ffd9b6e0764-7ffd9b6e0766 1602->1611 1612 7ffd9b6e0879-7ffd9b6e0896 1608->1612 1609->1612 1614 7ffd9b6e0779-7ffd9b6e078f 1610->1614 1611->1614 1620 7ffd9b6e089c-7ffd9b6e08aa call 7ffd9b6e0078 1612->1620 1621 7ffd9b6e0898-7ffd9b6e089a 1612->1621 1623 7ffd9b6e07a6-7ffd9b6e07ad 1614->1623 1624 7ffd9b6e0791-7ffd9b6e07a4 call 7ffd9b6e0078 1614->1624 1625 7ffd9b6e08ad-7ffd9b6e08b6 1620->1625 1621->1625 1628 7ffd9b6e07b4-7ffd9b6e07c7 1623->1628 1624->1623 1630 7ffd9b6e07cd-7ffd9b6e07d0 1624->1630 1625->1589 1628->1630 1631 7ffd9b6e07e7-7ffd9b6e07fa 1630->1631 1632 7ffd9b6e07d2-7ffd9b6e07e5 call 7ffd9b6e0078 1630->1632 1631->1556 1632->1556 1632->1631
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 27aa11b0ea52bb617f49923700ac806360556627be2db80aa600730371350153
                                                                                                                                                              • Instruction ID: 05bdde8cdcb703d7a8e8a57732c384a5cf03810c7c91e7606a58a3c90368b1a9
                                                                                                                                                              • Opcode Fuzzy Hash: 27aa11b0ea52bb617f49923700ac806360556627be2db80aa600730371350153
                                                                                                                                                              • Instruction Fuzzy Hash: 1C920736B0EB4A4FEBA9EB6C84B25A437E1FF55710B1501BAD099CF1A3DD18F8468740
                                                                                                                                                              Function 00007FFD9B6EC532 Relevance: 2.0, Strings: 1, Instructions: 743COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: \k~
                                                                                                                                                              • API String ID: 0-3643401465
                                                                                                                                                              • Opcode ID: 36382b44a6afc57c7289b4ae862b23701f87bbae1c499250af1ea3abac6e549b
                                                                                                                                                              • Instruction ID: 445bb799d86afda31b08c8223a41e06d0915b271d1a6f80ceb7b91317d5d3029
                                                                                                                                                              • Opcode Fuzzy Hash: 36382b44a6afc57c7289b4ae862b23701f87bbae1c499250af1ea3abac6e549b
                                                                                                                                                              • Instruction Fuzzy Hash: AD22D71BB0E51B49E625B6ADB4714FD2BB0EFD0331B150277D26DCE0E78D1876AA43A0
                                                                                                                                                              Function 00007FFD9B3D8014 Relevance: 1.7, APIs: 1, Instructions: 179COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              APIs
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3612137154.00007FFD9B3D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B3D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b3d0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: MitigationPolicyProcess
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 1088084561-0
                                                                                                                                                              • Opcode ID: 15cce4a2286b1f64b479be7a1fdbf80edab2ea5afe63fa587500d192de6fa2cb
                                                                                                                                                              • Instruction ID: da447a1ece44ca328adccf5036f65110b776f630e484d43dafbd1e1bdde1dc70
                                                                                                                                                              • Opcode Fuzzy Hash: 15cce4a2286b1f64b479be7a1fdbf80edab2ea5afe63fa587500d192de6fa2cb
                                                                                                                                                              • Instruction Fuzzy Hash: BB512831D0DB494FDB29EFA8985A5E97BE0EF55310F04027EE089C3292DB78B9468791
                                                                                                                                                              Function 00007FFD9B3D3662 Relevance: 1.6, APIs: 1, Instructions: 121pipeCOMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 1144 7ffd9b3d3662-7ffd9b3f5e80 ConnectNamedPipe 1148 7ffd9b3f5e88-7ffd9b3f5ed0 call 7ffd9b3f5ed1 1144->1148 1149 7ffd9b3f5e82 1144->1149 1149->1148
                                                                                                                                                              APIs
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3612137154.00007FFD9B3D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B3D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b3d0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: ConnectNamedPipe
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 2191148154-0
                                                                                                                                                              • Opcode ID: ff8ae6258b85c42deb79c7c77e296da7823d05568fe6c83be7672577971eb994
                                                                                                                                                              • Instruction ID: 41437fd67124476ab71053a0fe9367b345e1cf4a4998124dc6ab3243a998cec6
                                                                                                                                                              • Opcode Fuzzy Hash: ff8ae6258b85c42deb79c7c77e296da7823d05568fe6c83be7672577971eb994
                                                                                                                                                              • Instruction Fuzzy Hash: A3317E70E08A1C8FEB58EF98D849BE9B7F1FB68311F00826AD04DD7255DB74A9458B81
                                                                                                                                                              Function 00007FFD9B3D3AA2 Relevance: 1.6, APIs: 1, Instructions: 106COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 1153 7ffd9b3d3aa2-7ffd9b3d80ef 1155 7ffd9b3d80f6-7ffd9b3d8150 SetProcessMitigationPolicy 1153->1155 1156 7ffd9b3d8158-7ffd9b3d8187 1155->1156 1157 7ffd9b3d8152 1155->1157 1157->1156
                                                                                                                                                              APIs
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3612137154.00007FFD9B3D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B3D0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b3d0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID: MitigationPolicyProcess
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID: 1088084561-0
                                                                                                                                                              • Opcode ID: fbafcad90a99fbfd28bb139ad2f9a9c22573ae5e8a7618026d9088c5bad2a9b6
                                                                                                                                                              • Instruction ID: 6e2cec05bce5de6cc0f7a1cc2721304c6de30dabbacb3117fe362ecea546a5ea
                                                                                                                                                              • Opcode Fuzzy Hash: fbafcad90a99fbfd28bb139ad2f9a9c22573ae5e8a7618026d9088c5bad2a9b6
                                                                                                                                                              • Instruction Fuzzy Hash: 6B21A531918B188FDB28AF9D984AAF97BE0EB59711F00423EE04AD3251DB74B8458B91
                                                                                                                                                              Function 00007FFD9B6E1317 Relevance: 1.5, Strings: 1, Instructions: 231COMMON
                                                                                                                                                              Download Yara Rule

                                                                                                                                                              Control-flow Graph

                                                                                                                                                              • Executed
                                                                                                                                                              • Not Executed
                                                                                                                                                              control_flow_graph 1284 7ffd9b6e1317-7ffd9b6e1341 1289 7ffd9b6e1374-7ffd9b6e1378 1284->1289 1290 7ffd9b6e1343-7ffd9b6e1349 1284->1290 1293 7ffd9b6e137a-7ffd9b6e137b 1289->1293 1294 7ffd9b6e13f6-7ffd9b6e1489 1289->1294 1291 7ffd9b6e137c-7ffd9b6e13c0 1290->1291 1292 7ffd9b6e134b-7ffd9b6e1372 1290->1292 1291->1294 1309 7ffd9b6e3aa0-7ffd9b6e3ab8 1291->1309 1292->1289 1293->1291 1316 7ffd9b6e148b-7ffd9b6e14a5 1294->1316 1317 7ffd9b6e14f6-7ffd9b6e1503 1294->1317 1311 7ffd9b6e3abd-7ffd9b6e3ac4 1309->1311 1320 7ffd9b6e14a7-7ffd9b6e14ed 1316->1320 1321 7ffd9b6e14ef 1316->1321 1320->1321 1321->1317
                                                                                                                                                              Strings
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID: [
                                                                                                                                                              • API String ID: 0-784033777
                                                                                                                                                              • Opcode ID: a9851230d79628fdb369f1ab112e017eaa429bcadd1a1a5f952fd72c6a2d8fc1
                                                                                                                                                              • Instruction ID: b63b7c2c01a48c207659c748381ef667a5fcaa688a1dd8b3b360dc21b68e9a9c
                                                                                                                                                              • Opcode Fuzzy Hash: a9851230d79628fdb369f1ab112e017eaa429bcadd1a1a5f952fd72c6a2d8fc1
                                                                                                                                                              • Instruction Fuzzy Hash: 55615823A0F69A4BE721AB7C98710E57BA1EF42324B0902B7D0A88F1E3DD143956C751
                                                                                                                                                              Function 00007FFD9B6ECACD Relevance: .6, Instructions: 621COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 70a114b00ff8116bf850397697c3f30f7552f3e6f493cf0c3ae648fbdf1ce37b
                                                                                                                                                              • Instruction ID: 7953458452bed216a17ca285438a5dbbebcb34d475d67506f0bd4d7ce55165f0
                                                                                                                                                              • Opcode Fuzzy Hash: 70a114b00ff8116bf850397697c3f30f7552f3e6f493cf0c3ae648fbdf1ce37b
                                                                                                                                                              • Instruction Fuzzy Hash: ED02A317B0F16A1AE325B7ADB4B54E93F70EF41639B0A42B3D1AD8E0F3DC0935964294
                                                                                                                                                              Function 00007FFD9B6E6591 Relevance: .6, Instructions: 619COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 600933d7f16fef82735bfaf8a31b4efa18c2f7261197ce02f124b53a3cffeec1
                                                                                                                                                              • Instruction ID: c215c9c4c40b58d03c55aafd8ec7016f11b440d82c5a151fa25c088e86012b64
                                                                                                                                                              • Opcode Fuzzy Hash: 600933d7f16fef82735bfaf8a31b4efa18c2f7261197ce02f124b53a3cffeec1
                                                                                                                                                              • Instruction Fuzzy Hash: 5A024722B1E94F0BEBA5AB6C64756F53BD1EF84314F1A01BAD46DCB1E7DD18B8068340
                                                                                                                                                              Function 00007FFD9B6E92CC Relevance: .4, Instructions: 370COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 4ebc854d7ad16a997f54a4ae27f5b3e1c17a7d602b065aeedc5ff1493f8de335
                                                                                                                                                              • Instruction ID: 6ca53a7fba257e44d247ccf9a5ac63fff1fefc8d2da56a81d133089620df46cc
                                                                                                                                                              • Opcode Fuzzy Hash: 4ebc854d7ad16a997f54a4ae27f5b3e1c17a7d602b065aeedc5ff1493f8de335
                                                                                                                                                              • Instruction Fuzzy Hash: 8DB13871B1AA4E4FEBA5DB6888A967837D2EFD9300F1900B9D01CC72E6DE35BD018741
                                                                                                                                                              Function 00007FFD9B6E51BD Relevance: .4, Instructions: 361COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: d4a60182dbde65a11ddde43b2bcb0d95a6c4415e94c9356c78fafa4f7f40fef4
                                                                                                                                                              • Instruction ID: 17a540d338611cd0a9dff0fecb193891012a097dbcdc5c8329954af116f94983
                                                                                                                                                              • Opcode Fuzzy Hash: d4a60182dbde65a11ddde43b2bcb0d95a6c4415e94c9356c78fafa4f7f40fef4
                                                                                                                                                              • Instruction Fuzzy Hash: FDC1BF34719B098FDBDCEF58C0A5A6573E1FF98304B6509ADD029CF29ACA25F842CB40
                                                                                                                                                              Function 00007FFD9B6ECB00 Relevance: .4, Instructions: 359COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: dedf871ee92e35f3c330d72f65361386adb77e53755f1eac2b85a9eecca009ca
                                                                                                                                                              • Instruction ID: 38b3ef841bb17f5cdf7644a935dda65ea1cf19c3a98f40bcfc632ba0b71f7da9
                                                                                                                                                              • Opcode Fuzzy Hash: dedf871ee92e35f3c330d72f65361386adb77e53755f1eac2b85a9eecca009ca
                                                                                                                                                              • Instruction Fuzzy Hash: C3B1A617B0E1A61AE315B7ADB4B58E93F70EF4163970942B3D0DD8E0E3DC4835D68294
                                                                                                                                                              Function 00007FFD9B6E01FA Relevance: .4, Instructions: 350COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: d09973757a6cf59a84db40a803ab9a8b23195a336c9d5995a128c1afa5b24813
                                                                                                                                                              • Instruction ID: 9e1cb862adcb449149cfcba4cb7073bba38ce2bb57091b2d3603cbc58347e044
                                                                                                                                                              • Opcode Fuzzy Hash: d09973757a6cf59a84db40a803ab9a8b23195a336c9d5995a128c1afa5b24813
                                                                                                                                                              • Instruction Fuzzy Hash: 41C1CF38709B098FDBDCEE59C0A1AA573E1FFA430476509ADD069CF297CA25F846CB40
                                                                                                                                                              Function 00007FFD9B6E56C9 Relevance: .3, Instructions: 319COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: bc9fe8140806edf58e499e8db212fb09c379b177a2cda15cbf99bf340f724d94
                                                                                                                                                              • Instruction ID: 47a9acd301ad422d5edd8344ba22785201f8ca36ff2cf03f3c175e025e2138b3
                                                                                                                                                              • Opcode Fuzzy Hash: bc9fe8140806edf58e499e8db212fb09c379b177a2cda15cbf99bf340f724d94
                                                                                                                                                              • Instruction Fuzzy Hash: 82916C32B0EA4E4FEBB8EA1888A14B537D1EF50310715027FC46ECB1E6EE15B916C780
                                                                                                                                                              Function 00007FFD9B6E3EB5 Relevance: .3, Instructions: 289COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: dabb42117f612ceb4aed33efc646087bc912fca86d5c37c596038e89e02d1500
                                                                                                                                                              • Instruction ID: feeb33c43ef90e553dd3f4f9f30f9a71f9173d75c49d087db85268246310f392
                                                                                                                                                              • Opcode Fuzzy Hash: dabb42117f612ceb4aed33efc646087bc912fca86d5c37c596038e89e02d1500
                                                                                                                                                              • Instruction Fuzzy Hash: A2A19E35709A4A4FDB9DEB28C0A16A577A1FFA8304B2505BDC069CF29BCA25F842C740
                                                                                                                                                              Function 00007FFD9B6E67A4 Relevance: .2, Instructions: 217COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 6c96515b8055a8ddfb90c67980b34458390a1164bf71bb03f0215c4d17c9a0ca
                                                                                                                                                              • Instruction ID: 78cdf801fbe615afd0366688f89162a21e42c142b0a100856f9adfc35caea4bc
                                                                                                                                                              • Opcode Fuzzy Hash: 6c96515b8055a8ddfb90c67980b34458390a1164bf71bb03f0215c4d17c9a0ca
                                                                                                                                                              • Instruction Fuzzy Hash: 13511A16B1E59A0FE756B76CB8719E93FA1DF81224B0D02F6D09CCB0EBDC1868468351
                                                                                                                                                              Function 00007FFD9B6EB28A Relevance: .2, Instructions: 215COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 5806adc89c5be656e19ce63e7a31bd2ef03289dd7ae9f1d7375121a865a84e4e
                                                                                                                                                              • Instruction ID: 23cafbba7afe497061f94de6059d447ddf64a965726848dfa4eeecf679ac5f01
                                                                                                                                                              • Opcode Fuzzy Hash: 5806adc89c5be656e19ce63e7a31bd2ef03289dd7ae9f1d7375121a865a84e4e
                                                                                                                                                              • Instruction Fuzzy Hash: 24619031B1990D8FEB94EB6C94A5BB873E2EF98700F5541B9E01DC72EACD28BD418741
                                                                                                                                                              Function 00007FFD9B6E275E Relevance: .2, Instructions: 191COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 2a984ec79618837b0987a39d6071696c8eebfdd9f3ee8537ac106af4edc884be
                                                                                                                                                              • Instruction ID: 63f178cd5123fc7fa1db99f033fc41c58e16c50b647ac71f9ff30fe909f494c4
                                                                                                                                                              • Opcode Fuzzy Hash: 2a984ec79618837b0987a39d6071696c8eebfdd9f3ee8537ac106af4edc884be
                                                                                                                                                              • Instruction Fuzzy Hash: EF51F37270DA4D4FEB98DF58C864AA533D2FFA8310B0501B9D45DDB2A6DE21F816CB40
                                                                                                                                                              Function 00007FFD9B6EC903 Relevance: .2, Instructions: 178COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 79326c5fa503a6f0d8195abbeccdbd47d6ba8ec6d4a2014fd6ff3dd25bfd09aa
                                                                                                                                                              • Instruction ID: 0c24dcd97a29e86c6101904c911066cefdf48cdc057af60fc2356174b1654b08
                                                                                                                                                              • Opcode Fuzzy Hash: 79326c5fa503a6f0d8195abbeccdbd47d6ba8ec6d4a2014fd6ff3dd25bfd09aa
                                                                                                                                                              • Instruction Fuzzy Hash: 07414712B1ED4E0FE7A4E76C58A6AB937E1EB94250B554176E02CC72EBEC08B9464381
                                                                                                                                                              Function 00007FFD9B6E6C4B Relevance: .2, Instructions: 170COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 287e95436beae0042fc24194649495463e409784ea1c5e1a0f22373513fcd041
                                                                                                                                                              • Instruction ID: 92c6467c92e6c923b60996846addb0b3f789eccfe84ea0379c4296cf3d81102c
                                                                                                                                                              • Opcode Fuzzy Hash: 287e95436beae0042fc24194649495463e409784ea1c5e1a0f22373513fcd041
                                                                                                                                                              • Instruction Fuzzy Hash: AD518C72B1ED4E0BE769AF6884616B43791EF90350F04417ED45ECB0E7EE29B9568340
                                                                                                                                                              Function 00007FFD9B6E3F20 Relevance: .2, Instructions: 168COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 8e0f0a30135248e911657fede1b168ab6743063088a12aac865355055196d26a
                                                                                                                                                              • Instruction ID: 5dd756e8d9f68aff89409aeb060430ae61b32d47dc9da82f01370df6d7d96bdd
                                                                                                                                                              • Opcode Fuzzy Hash: 8e0f0a30135248e911657fede1b168ab6743063088a12aac865355055196d26a
                                                                                                                                                              • Instruction Fuzzy Hash: C451323570DA4A8FDBDDEF68C0A466173A1FFA830472445ADC06DCF69ACA25F846C740
                                                                                                                                                              Function 00007FFD9B6E60E9 Relevance: .2, Instructions: 165COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 45f8eae881e39fb9fd4f049dd8993b84e26dd365032d07d273c00ed6771903c8
                                                                                                                                                              • Instruction ID: 94384cd5b01ab74fa6e42ba17714cf6fe0ee45c96ea2a36dbb9aee415fb081d1
                                                                                                                                                              • Opcode Fuzzy Hash: 45f8eae881e39fb9fd4f049dd8993b84e26dd365032d07d273c00ed6771903c8
                                                                                                                                                              • Instruction Fuzzy Hash: 6E51A371709A8D4FDB99DF28C8A09A53B91FF59314B1101ADE42ECB2E2DB35F852C700
                                                                                                                                                              Function 00007FFD9B6EBF4C Relevance: .1, Instructions: 145COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 59a30ce428e362c42d19757269e829971a4d7813841466882ec4e49bb0c86dec
                                                                                                                                                              • Instruction ID: 2e5206d0ab1343425ff8a07192dbec457b3c50631d186801d0046d803050d7b7
                                                                                                                                                              • Opcode Fuzzy Hash: 59a30ce428e362c42d19757269e829971a4d7813841466882ec4e49bb0c86dec
                                                                                                                                                              • Instruction Fuzzy Hash: BE416A22B1EB890FE796976C98B15A47BE0EF95200B0901FBE05DCF1E7DD09BD058341
                                                                                                                                                              Function 00007FFD9B6EC8BF Relevance: .1, Instructions: 142COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 7102f1a57d89a4907e389dd5c595b5383827c59315d69f6623fd5303e5b11794
                                                                                                                                                              • Instruction ID: 843513f40601a5408a4854069e1f73dbb012248a97811f6776bd3b71b0eb0b7e
                                                                                                                                                              • Opcode Fuzzy Hash: 7102f1a57d89a4907e389dd5c595b5383827c59315d69f6623fd5303e5b11794
                                                                                                                                                              • Instruction Fuzzy Hash: 95411712F29D4E0FE798EB5C58A6AB973E1FF94640B5042B6E01DC32EBDD18F9424381
                                                                                                                                                              Function 00007FFD9B6E4461 Relevance: .1, Instructions: 137COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: fdd0b6c285c12a74be874311481d4d98b69ec3d9e5adac49dcd98b8fe2ba64e0
                                                                                                                                                              • Instruction ID: f1e353a023987b0f9c98712e8968ac9ed242b70187ac91aad30708694f61a4c1
                                                                                                                                                              • Opcode Fuzzy Hash: fdd0b6c285c12a74be874311481d4d98b69ec3d9e5adac49dcd98b8fe2ba64e0
                                                                                                                                                              • Instruction Fuzzy Hash: 7731E663B0AD4D4FEBA9DA7C48A56B863C2DFA9240B0501BFD06DCB1E7ED05BD164340
                                                                                                                                                              Function 00007FFD9B6E93B6 Relevance: .1, Instructions: 134COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 13b14a44e931acfa07bf06475a8993d50ea295a294afbaa724fefbf031d7b350
                                                                                                                                                              • Instruction ID: adba3786033672a801da20a4fa458b7b7916e5d3aa5c3eef933efc756171f4e5
                                                                                                                                                              • Opcode Fuzzy Hash: 13b14a44e931acfa07bf06475a8993d50ea295a294afbaa724fefbf031d7b350
                                                                                                                                                              • Instruction Fuzzy Hash: D641EA72B1EA8E4FEB95DB6888786683B91EF95340F5900BDD05CC71E2DE35B941C701
                                                                                                                                                              Function 00007FFD9B6EBCD5 Relevance: .1, Instructions: 131COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 351a7104f575c9321a7ed1cb0245079dace7f077210889ec2952e8ab618f8718
                                                                                                                                                              • Instruction ID: b6f59f045c1c574253b6d0607fc13d9e44707a7b3c9af856dee652ada49d81d0
                                                                                                                                                              • Opcode Fuzzy Hash: 351a7104f575c9321a7ed1cb0245079dace7f077210889ec2952e8ab618f8718
                                                                                                                                                              • Instruction Fuzzy Hash: 6A314C31B1AD0E4FE755EB2C98A46B873C1FF94350B58067AD41DC71AADE24FD424381
                                                                                                                                                              Function 00007FFD9B6EBFDE Relevance: .1, Instructions: 122COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 8303dbcfbb4562a32e79a2ed26beda87ece483f17c897f39a80d4d9cec72848c
                                                                                                                                                              • Instruction ID: 211ddea0962891c02b33b7b95f2dbd52e870e97685fc763765b6e3be84b3f678
                                                                                                                                                              • Opcode Fuzzy Hash: 8303dbcfbb4562a32e79a2ed26beda87ece483f17c897f39a80d4d9cec72848c
                                                                                                                                                              • Instruction Fuzzy Hash: 57313D22B1FB8A0FE7A6976CA875DA53BA0EF5125070941FBD069CF0E7DD09BD068341
                                                                                                                                                              Function 00007FFD9B6ECDFB Relevance: .1, Instructions: 118COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 7ed877f2176503beffb7d5a30f420994da0840d178a1c93bdefe3ba394c7c55f
                                                                                                                                                              • Instruction ID: b1f4322116279ae56c001d7da279e115c74ebb2530928751e1be33d202dbbd56
                                                                                                                                                              • Opcode Fuzzy Hash: 7ed877f2176503beffb7d5a30f420994da0840d178a1c93bdefe3ba394c7c55f
                                                                                                                                                              • Instruction Fuzzy Hash: E631AD27A0A2695BE351F76CE4F55EA3F70DF41228B0902F3D09DDA0A7ED1435964390
                                                                                                                                                              Function 00007FFD9B6E5E00 Relevance: .1, Instructions: 103COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: a1c25e09eef372610d58e88ebc135dfb7e1d1e5810a4af7318d7d13cdf2dfcb0
                                                                                                                                                              • Instruction ID: 8f9a86b803da9542f3e47ad188d1b8a7e1ce58c6ee90bbb3439bf7692270fc0e
                                                                                                                                                              • Opcode Fuzzy Hash: a1c25e09eef372610d58e88ebc135dfb7e1d1e5810a4af7318d7d13cdf2dfcb0
                                                                                                                                                              • Instruction Fuzzy Hash: AC213752F1FA9E0FE7A6A7AC18B21E42BA1EF9111070A01F7C46CCF1E7DC19A8558351
                                                                                                                                                              Function 00007FFD9B6E4E59 Relevance: .1, Instructions: 97COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: a6464d3906c7cfa74f9d4db1097f2a0445ee7510b4f917ca8224be5904b6c7b9
                                                                                                                                                              • Instruction ID: c58c6e95538ff0eed56153d85c7d92f76eb19b62dc5b12b63ddc8b75961b3c3b
                                                                                                                                                              • Opcode Fuzzy Hash: a6464d3906c7cfa74f9d4db1097f2a0445ee7510b4f917ca8224be5904b6c7b9
                                                                                                                                                              • Instruction Fuzzy Hash: 7321D512A0E78B0FE775977848712786AD19F82240F0A81BEC0ADCF1E3DD1CAA568301
                                                                                                                                                              Function 00007FFD9B6E5961 Relevance: .1, Instructions: 96COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 1725bf125491b9ff7e2310ce93c837effcc4ca5bc35e0778485c45e158b1a915
                                                                                                                                                              • Instruction ID: 2a018fc1d1b14c63a2a4d40a1812b94407da45153beb01578cfd1b57277d15cc
                                                                                                                                                              • Opcode Fuzzy Hash: 1725bf125491b9ff7e2310ce93c837effcc4ca5bc35e0778485c45e158b1a915
                                                                                                                                                              • Instruction Fuzzy Hash: 12212732B0DE0E0BEF54EB6C98928F573D1EB50320740013BE569C7197ED19F9628781
                                                                                                                                                              Function 00007FFD9B6E5E10 Relevance: .1, Instructions: 95COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: c3dead49426fb6addc403eced2d190cf20bf333b7daf14816c485ae11e98153d
                                                                                                                                                              • Instruction ID: e467d9c6ff9dda15bd8204c850d9f0bfe1dbcd1804b25470fb561b6054a2091b
                                                                                                                                                              • Opcode Fuzzy Hash: c3dead49426fb6addc403eced2d190cf20bf333b7daf14816c485ae11e98153d
                                                                                                                                                              • Instruction Fuzzy Hash: 3D210612F1FA9E0FE7A6A6AC18B11E42BA1EF9511074A01F7C46CCF1E7DC18A9558391
                                                                                                                                                              Function 00007FFD9B6ED9D2 Relevance: .1, Instructions: 91COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: a845052f1ce916ee259ee0b5eb84e991ed2903e04d62cb46202d45954f768a8f
                                                                                                                                                              • Instruction ID: 648ebd65ba36e842a63b77f39ce9d4bd015e8de808f15412f7ffa91012c8b4e8
                                                                                                                                                              • Opcode Fuzzy Hash: a845052f1ce916ee259ee0b5eb84e991ed2903e04d62cb46202d45954f768a8f
                                                                                                                                                              • Instruction Fuzzy Hash: CB310971F0960E0FF764BB68C4653A53AA1EF45300F55447AC46DEB3E2ED2C7A558341
                                                                                                                                                              Function 00007FFD9B6E7FA5 Relevance: .1, Instructions: 86COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: cf82dc5d6cacd9adfdeb37c4f228cdf92779d2a96662eea3d889a343ddd1e9a4
                                                                                                                                                              • Instruction ID: 17420b9d6935732191b1f1308a0fa535e6d26491ba9788f9c8ad0d1d593bea69
                                                                                                                                                              • Opcode Fuzzy Hash: cf82dc5d6cacd9adfdeb37c4f228cdf92779d2a96662eea3d889a343ddd1e9a4
                                                                                                                                                              • Instruction Fuzzy Hash: F321C120B0FA4A4FE7B597A85434A7562D2AF95340F4640BAC05DCF1F2CD1CBA258350
                                                                                                                                                              Function 00007FFD9B6E5E20 Relevance: .1, Instructions: 85COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 945193c624f75e8bcee9e7adee6e71b71100f0c647d6217dbc95204e6a39c8fb
                                                                                                                                                              • Instruction ID: a586459673fac7ebc7fc98b806708d7133a0c6606c867df5f79f1af46f1ba0e6
                                                                                                                                                              • Opcode Fuzzy Hash: 945193c624f75e8bcee9e7adee6e71b71100f0c647d6217dbc95204e6a39c8fb
                                                                                                                                                              • Instruction Fuzzy Hash: 3F213512F1FA8E0FE7A6ABAC18B21A42BA1EF9511074A01F7D06CCF1E7DC1CAD558351
                                                                                                                                                              Function 00007FFD9B6E5E30 Relevance: .1, Instructions: 75COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: d601da0189b691c736530b2cd676b5edd634c95d9a34b35d30c83683a93cbee2
                                                                                                                                                              • Instruction ID: a19c1c15c15edacaf32f773d7308ce40a2866335abd1d41f695f2352e74d8093
                                                                                                                                                              • Opcode Fuzzy Hash: d601da0189b691c736530b2cd676b5edd634c95d9a34b35d30c83683a93cbee2
                                                                                                                                                              • Instruction Fuzzy Hash: A0112652F2FA8E0EE7A6ABAC18B11A41BA1EF9511074A01F6D02CCF1E7DC1CA9958351
                                                                                                                                                              Function 00007FFD9B6EB654 Relevance: .1, Instructions: 72COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 764da1354a0d9a6a83c7772ac3c9a9f420023a0f60a4b3cb4dbee1c4fa839a54
                                                                                                                                                              • Instruction ID: 9f7d6f0ea2ccb5242c529ba462b3d6e5d4fafaf798724572ef2c1385b471c5a5
                                                                                                                                                              • Opcode Fuzzy Hash: 764da1354a0d9a6a83c7772ac3c9a9f420023a0f60a4b3cb4dbee1c4fa839a54
                                                                                                                                                              • Instruction Fuzzy Hash: 8B11E63170D20E4EEB5DEA98E8622F83380EFC5225F04007DD16EDB8A3DE2A75278741
                                                                                                                                                              Function 00007FFD9B6E5F7D Relevance: .1, Instructions: 71COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 1e4d2419706125900ade3cf376a2037ab79151418b291fe9cec356ac337faf2f
                                                                                                                                                              • Instruction ID: c49d6dee544fa1ef3e901c2dfa64aef76111cef665e23ac9297a4b88f698ea8e
                                                                                                                                                              • Opcode Fuzzy Hash: 1e4d2419706125900ade3cf376a2037ab79151418b291fe9cec356ac337faf2f
                                                                                                                                                              • Instruction Fuzzy Hash: 4111B772E0DB4C4FDF91DF9448B55A97FA1EF55300F0500EAD4ADDB1A2DA217511CB41
                                                                                                                                                              Function 00007FFD9B6E25C0 Relevance: .1, Instructions: 69COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: c90660ad65d9edf6a9b356853ee1d416c98350e4f6129d17161bf185fb1e4f9c
                                                                                                                                                              • Instruction ID: 1748ca3f4fb71ac48ef584230ea5cf79955db8c558eb6ce30630b70c33ce2012
                                                                                                                                                              • Opcode Fuzzy Hash: c90660ad65d9edf6a9b356853ee1d416c98350e4f6129d17161bf185fb1e4f9c
                                                                                                                                                              • Instruction Fuzzy Hash: C211A571B09A494FD799DF58C4A496573D2FFA8700B15017ED46DC72A2DE21BC52CB40
                                                                                                                                                              Function 00007FFD9B6E280C Relevance: .1, Instructions: 64COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 020fbeb56e020f253006734c5f3ca0c5ddef9cf096a69012bfb278e8835ee699
                                                                                                                                                              • Instruction ID: f1c0d465211cffd67887bfc8453d81c59af290f7c9044459f7937688642b1691
                                                                                                                                                              • Opcode Fuzzy Hash: 020fbeb56e020f253006734c5f3ca0c5ddef9cf096a69012bfb278e8835ee699
                                                                                                                                                              • Instruction Fuzzy Hash: C111BE71B0994D4FEBA8EF58C464B6573A2FFA8300B0541B8C45DCF297DE25F9468780
                                                                                                                                                              Function 00007FFD9B6E2875 Relevance: .1, Instructions: 63COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 0379c7f8cb7ef5e4595fcce9f2bc280ab6d44c2c6f45cd5fc91f82789184ea91
                                                                                                                                                              • Instruction ID: 56bc42123ab2ae453f7c9086eecec58091709c15222e3c84ac03c39138dce7e6
                                                                                                                                                              • Opcode Fuzzy Hash: 0379c7f8cb7ef5e4595fcce9f2bc280ab6d44c2c6f45cd5fc91f82789184ea91
                                                                                                                                                              • Instruction Fuzzy Hash: E411BB71B099494FEB98EF68C464BA573A2FFA8300B0541A8C45DCB297DA25F9068B80
                                                                                                                                                              Function 00007FFD9B6EDB4D Relevance: .1, Instructions: 62COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 33521dbb58b5ef0681b4ac0c66f92e5c6f7d72f0d508ee8ba14a39f752893b8f
                                                                                                                                                              • Instruction ID: 3a48fe7b21f037d8c6bf9f4f41abc4d85fe25049c0d33fd1659d68fb0b87334f
                                                                                                                                                              • Opcode Fuzzy Hash: 33521dbb58b5ef0681b4ac0c66f92e5c6f7d72f0d508ee8ba14a39f752893b8f
                                                                                                                                                              • Instruction Fuzzy Hash: 7B119375A1A91C9FDBE4EB58C899E9877F1EF68310F5041E9A41DD7262DE34AD808B00
                                                                                                                                                              Function 00007FFD9B6E1170 Relevance: .1, Instructions: 61COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 4213fc2a290cb2eb341f6d244448be7039a920f61ce19932fda4c2b68e4e7926
                                                                                                                                                              • Instruction ID: 266592536ab8b99d1f0cc3f64ad31d37b009fd81aa8db8fe59cbb3231d9461b7
                                                                                                                                                              • Opcode Fuzzy Hash: 4213fc2a290cb2eb341f6d244448be7039a920f61ce19932fda4c2b68e4e7926
                                                                                                                                                              • Instruction Fuzzy Hash: 59012D51F2AD0E0EE7A4ABAC14E56B552D2FBE821075141B9D01DC719BDC29F9514350
                                                                                                                                                              Function 00007FFD9B6EB5AD Relevance: .1, Instructions: 58COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 9d9a249896359989f922e76fc20e5180aed70453aa0f9d79c9c3c1adc8907b53
                                                                                                                                                              • Instruction ID: a6a787569a2259e8109d0f2767ba1755f6d15eba195dd375fe6ba01bba561779
                                                                                                                                                              • Opcode Fuzzy Hash: 9d9a249896359989f922e76fc20e5180aed70453aa0f9d79c9c3c1adc8907b53
                                                                                                                                                              • Instruction Fuzzy Hash: 53112561F1EE4E0BEB689B6864A416133D2FF9434075942B9E029CB1EAEE25B9124340
                                                                                                                                                              Function 00007FFD9B6EB5CE Relevance: .1, Instructions: 53COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 2b4ac10bceb4a083c79914fae1742526fa0dc1479656e85f06bb278fa0a51764
                                                                                                                                                              • Instruction ID: 3ea30105421177d4d6edfb4f41762ed3ce032f3a882ba80304a4c7c742f8b1e2
                                                                                                                                                              • Opcode Fuzzy Hash: 2b4ac10bceb4a083c79914fae1742526fa0dc1479656e85f06bb278fa0a51764
                                                                                                                                                              • Instruction Fuzzy Hash: C4012621F1AD0E0BE7A8961894A456033D2FF9834075945B9D01DC71AAEE25B9024340
                                                                                                                                                              Function 00007FFD9B6E682C Relevance: .0, Instructions: 45COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: c62b2f537bf5d4015732582c04e673bb933f22e197516e2c2674e659333e670b
                                                                                                                                                              • Instruction ID: cf6d89c06d7b471403c76a9deaa3f9ca099a75700702df775cddf65fab64cffa
                                                                                                                                                              • Opcode Fuzzy Hash: c62b2f537bf5d4015732582c04e673bb933f22e197516e2c2674e659333e670b
                                                                                                                                                              • Instruction Fuzzy Hash: 2A014F70B2B51F49FEB8EA9540B06BA16D1AF94311F46017CD86E8E1E7CE28BA14C321
                                                                                                                                                              Function 00007FFD9B6EC4CD Relevance: .0, Instructions: 45COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 35ed5a6fadd932021c3cf9bd69c3931ac473a9980a9db32351894e6237e40270
                                                                                                                                                              • Instruction ID: 204ee13434a0316c05ae50bcab0e417088368b5f684d417c3cbdc85eab788761
                                                                                                                                                              • Opcode Fuzzy Hash: 35ed5a6fadd932021c3cf9bd69c3931ac473a9980a9db32351894e6237e40270
                                                                                                                                                              • Instruction Fuzzy Hash: B9F09021B0AD0D4FE6A4FABC986927C32D2FFD82457514ABED00DC32AADD25AC454740
                                                                                                                                                              Function 00007FFD9B6EDC42 Relevance: .0, Instructions: 40COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 835cdda0d43b88053403915d9d0f83e2278122fe8a59987bf7af3609c805c8d5
                                                                                                                                                              • Instruction ID: e4647163aea42ab3cfc4337a29c17e283940263131b13dde3b79a96cd94830bd
                                                                                                                                                              • Opcode Fuzzy Hash: 835cdda0d43b88053403915d9d0f83e2278122fe8a59987bf7af3609c805c8d5
                                                                                                                                                              • Instruction Fuzzy Hash: AA01E831E1592D8EDBA4EB5894A97E8B3B1EF98701F4102FAD12DD6161DE356AD08B00
                                                                                                                                                              Function 00007FFD9B6EDDE0 Relevance: .0, Instructions: 40COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: cfd2f60f3992e1d2cf66d67dafda2406c785edc2f9642e8a7f092f80596014ca
                                                                                                                                                              • Instruction ID: 31f86b882d8bf5338af2ba8a8128e04752d51b350f6436c07989f9f657a2f60f
                                                                                                                                                              • Opcode Fuzzy Hash: cfd2f60f3992e1d2cf66d67dafda2406c785edc2f9642e8a7f092f80596014ca
                                                                                                                                                              • Instruction Fuzzy Hash: 67E09BB114E50C6EA61CAA55AC079F7379CE787134F40111FE18E85012F153B5238295
                                                                                                                                                              Function 00007FFD9B6ECF4D Relevance: .0, Instructions: 39COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 92921cf3cc42528d8e6c647b2dc76af4be2864d80aec04caeb09bcda33610eaf
                                                                                                                                                              • Instruction ID: 1f317e2c9fb2283f9c9b29564e4ccb4b908954010cc02325c46944ff146a6e0a
                                                                                                                                                              • Opcode Fuzzy Hash: 92921cf3cc42528d8e6c647b2dc76af4be2864d80aec04caeb09bcda33610eaf
                                                                                                                                                              • Instruction Fuzzy Hash: 00016234905A1C8FDB58EF04C8A97A9B3F0FB54301F4006AEC01AD3251CF352A85CF41
                                                                                                                                                              Function 00007FFD9B6E43F9 Relevance: .0, Instructions: 32COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: de21e907f3bda7255f8c0a39f7d7e97676c6c5a0acd1b8f8677a321b4da46167
                                                                                                                                                              • Instruction ID: 05e6db367ca26e4332f8390f7e92385c855e0f613678c69f9f9c726052eda45d
                                                                                                                                                              • Opcode Fuzzy Hash: de21e907f3bda7255f8c0a39f7d7e97676c6c5a0acd1b8f8677a321b4da46167
                                                                                                                                                              • Instruction Fuzzy Hash: E3F0C232A1DB8C4FD315AB34846A1A57F71FF55200B4501FED458CB197DE289914C781
                                                                                                                                                              Function 00007FFD9B6E09B1 Relevance: .0, Instructions: 31COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 4c5cf20f8f089cbf0fce4cd45530c27e4693210ea9b324428c72b282b5187fee
                                                                                                                                                              • Instruction ID: 7bf85193452a42de8afb24a1dfb88fb91b71714a9a0f17195484bebe24f3bf67
                                                                                                                                                              • Opcode Fuzzy Hash: 4c5cf20f8f089cbf0fce4cd45530c27e4693210ea9b324428c72b282b5187fee
                                                                                                                                                              • Instruction Fuzzy Hash: D7E0DF2250F7D40FEB929B38C4A88E13FA0EE2322030901EBD581CF0B3E5189A9AC751
                                                                                                                                                              Function 00007FFD9B6E3A89 Relevance: .0, Instructions: 30COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 7ec36fc5198cad00aa57a6c1262ed243890faaa42d533f4eb803714d1f9d88f4
                                                                                                                                                              • Instruction ID: 92ba74d471cba9acd420d41f3f08ee352d190bf135741192a83ec435aed41fd2
                                                                                                                                                              • Opcode Fuzzy Hash: 7ec36fc5198cad00aa57a6c1262ed243890faaa42d533f4eb803714d1f9d88f4
                                                                                                                                                              • Instruction Fuzzy Hash: A2F06D314097999FCB42EB64D4A5DD6FFB4EF06310B0541DBE049CF062E7219A59CBC2
                                                                                                                                                              Function 00007FFD9B6E4E70 Relevance: .0, Instructions: 24COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 572ff502807833985cb960d525cd4d7c00baa349405b3b36b7dd98b900255d67
                                                                                                                                                              • Instruction ID: 25ff620ba555566fa574b053836069ac04ae8e27d6b119702bbf5331e350f04a
                                                                                                                                                              • Opcode Fuzzy Hash: 572ff502807833985cb960d525cd4d7c00baa349405b3b36b7dd98b900255d67
                                                                                                                                                              • Instruction Fuzzy Hash: 77E08C16B4EA0B02FB7C61B568B13B960919F44300F4A81BE942DC80E9CD6CAF908292
                                                                                                                                                              Function 00007FFD9B6EC069 Relevance: .0, Instructions: 21COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 84c5d40a27ac27fd8331e6513560d1643b1c0f577617a0824983939f7cdab85e
                                                                                                                                                              • Instruction ID: a7068b807074f738ee93699e1f8c4c301b8c70bd13be7aff778fca265148516d
                                                                                                                                                              • Opcode Fuzzy Hash: 84c5d40a27ac27fd8331e6513560d1643b1c0f577617a0824983939f7cdab85e
                                                                                                                                                              • Instruction Fuzzy Hash: 4DE0127161DA494FE794DB5CE4A29A9F7E0FBD8294F40067EF08DD2260DA25E6808701
                                                                                                                                                              Function 00007FFD9B6EC4AD Relevance: .0, Instructions: 13COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 220a30f144608d28c85bb7ee52dc1ff5e0f5fea4b0e269bb7baa8d94eca2b879
                                                                                                                                                              • Instruction ID: 22796beb9bda85000dd8d68794a492ca81989b44072c7122ee0948b6ca4fb756
                                                                                                                                                              • Opcode Fuzzy Hash: 220a30f144608d28c85bb7ee52dc1ff5e0f5fea4b0e269bb7baa8d94eca2b879
                                                                                                                                                              • Instruction Fuzzy Hash: 4CC0127370B50A4AF7A4A178002917481C1AB99280752047CD01DCB1F2FC2969178600
                                                                                                                                                              Function 00007FFD9B6E2914 Relevance: .0, Instructions: 8COMMON
                                                                                                                                                              Download Yara Rule
                                                                                                                                                              Memory Dump Source
                                                                                                                                                              • Source File: 00000008.00000002.3619625379.00007FFD9B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6E0000, based on PE: false
                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                              • Snapshot File: hcaresult_8_2_7ffd9b6e0000_ScreenConnect.jbxd
                                                                                                                                                              Similarity
                                                                                                                                                              • API ID:
                                                                                                                                                              • String ID:
                                                                                                                                                              • API String ID:
                                                                                                                                                              • Opcode ID: 734bc0f4e55be1c2504517cf8cfe665577502c3048652af4dfacc2674704c7f8
                                                                                                                                                              • Instruction ID: a9bdf873043de3d530a90185552c84f0d9abdcc816b97f2473a6b617c107027a
                                                                                                                                                              • Opcode Fuzzy Hash: 734bc0f4e55be1c2504517cf8cfe665577502c3048652af4dfacc2674704c7f8
                                                                                                                                                              • Instruction Fuzzy Hash: AAC09B10F1A54F56F574FBA4447517D11937FC8201B538539D02D85196CD3D77115645