Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
ScreenConnect.ClientSetup (1).exe

Overview

General Information

Sample name:ScreenConnect.ClientSetup (1).exe
Analysis ID:1524529
MD5:2fbf1296c804795cd2f5e0a301307472
SHA1:e13a457725b54359e6b7f75d496490efc650c48c
SHA256:4fc0719c59038e56d10d8b979a40636005aa39e57e3588a0d2a660285c53f9b5
Infos:

Detection

ScreenConnect Tool
Score:57
Range:0 - 100
Whitelisted:false
Confidence:100%

Compliance

Score:33
Range:0 - 100

Signatures

.NET source code contains potential unpacker
.NET source code references suspicious native API functions
AI detected suspicious sample
Contains functionality to hide user accounts
Enables network access during safeboot for specific services
Modifies security policies related information
Reads the Security eventlog
Reads the System eventlog
Sigma detected: Remote Access Tool - ScreenConnect Suspicious Execution
Allocates memory with a write watch (potentially for evading sandboxes)
Checks for available system drives (often done to infect USB drives)
Contains functionality to launch a process as a different user
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates or modifies windows services
Deletes files inside the Windows folder
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
EXE planting / hijacking vulnerabilities found
Enables debug privileges
Found dropped PE file which has not been started or loaded
May sleep (evasive loops) to hinder dynamic analysis
May use bcdedit to modify the Windows boot settings
Modifies existing windows services
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected ScreenConnect Tool

Classification

Process Tree

  • System is w10x64
  • ScreenConnect.ClientSetup (1).exe (PID: 5208 cmdline: "C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exe" MD5: 2FBF1296C804795CD2F5E0A301307472)
    • msiexec.exe (PID: 5276 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ScreenConnect\ccf23f1afa8af061\setup.msi" MD5: 9D09DC1EDA745A5F87553048E57620CF)
  • msiexec.exe (PID: 4236 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)
    • msiexec.exe (PID: 3392 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding BC108F69163DAA59A6F9981178743870 C MD5: 9D09DC1EDA745A5F87553048E57620CF)
      • rundll32.exe (PID: 6932 cmdline: rundll32.exe "C:\Users\user\AppData\Local\Temp\MSICF5E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_7262203 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments MD5: 889B99C52A60DD49227C5E485A016679)
    • msiexec.exe (PID: 5612 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding CCDB78175ACA179D0D189E42F6A15F79 MD5: 9D09DC1EDA745A5F87553048E57620CF)
    • msiexec.exe (PID: 5700 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 644E16E75658CB40C644CEA9BB61A5D0 E Global\MSI0000 MD5: 9D09DC1EDA745A5F87553048E57620CF)
  • ScreenConnect.ClientService.exe (PID: 1372 cmdline: "C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-f13iq7-relay.screenconnect.com&p=443&s=8c4565db-ac67-42c5-9630-9aa3f157ab83&k=BgIAAACkAABSU0ExAAgAAAEAAQC1MY9w4B1kmCI8rrVVcN3Qv2pF2incNEaC5%2f57%2frQys%2fxWV8jitTHxen5sI4Wll36RpM9KV99bb78RmSViUCckbjE5KmpupWzSRQPRoXSxvLn2bqJ43r%2b0c1Xzj6wxUS%2bGCdb3y5osDTbAX4izwcSX%2fWd5MibcXFXyV0GDsYs7uPqQNXSNtw1v5PTrV4hH6KEn7iG8xD119OfXklw0j4quXgapgwpI4dZ5E20CIMcRqfPC5dqnBzSKD%2bnQ0l48Ao%2fzM5ObrNV%2f8giwIObi%2f%2b9H0BQvztiy4rypOySEqrH3oVDeR1OWmdV0FGCTguAa5uyNJoKXRLqK4n1ztMQHr%2f%2bi&c=Van%20Buren%20Telephone%20Company&c=&c=&c=&c=&c=&c=&c=" MD5: 361BCC2CB78C75DD6F583AF81834E447)
    • ScreenConnect.WindowsClient.exe (PID: 5156 cmdline: "C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exe" "RunRole" "45494334-b96f-4a01-b0ee-df000a95fbae" "User" MD5: 20AB8141D958A58AADE5E78671A719BF)
  • svchost.exe (PID: 3080 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
ScreenConnect.ClientSetup (1).exeJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security

    Dropped Files

    SourceRuleDescriptionAuthorStrings
    C:\Config.Msi\6ed328.rbsJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
      C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
        C:\Windows\Installer\MSID52B.tmpJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security

          Memory Dumps

          SourceRuleDescriptionAuthorStrings
          00000000.00000002.2155563654.0000000005CC0000.00000004.08000000.00040000.00000000.sdmpJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
            00000009.00000000.2182692087.0000000000622000.00000002.00000001.01000000.00000011.sdmpJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
              00000009.00000002.3384013467.0000000002821000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                00000000.00000000.2128643109.0000000000026000.00000002.00000001.01000000.00000003.sdmpJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                  Process Memory Space: ScreenConnect.ClientSetup (1).exe PID: 5208JoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                    Click to see the 3 entries

                    Unpacked PEs

                    SourceRuleDescriptionAuthorStrings
                    0.2.ScreenConnect.ClientSetup (1).exe.5cc0000.7.raw.unpackJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                      9.2.ScreenConnect.WindowsClient.exe.289fa28.2.raw.unpackJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                        9.0.ScreenConnect.WindowsClient.exe.620000.0.unpackJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                          0.0.ScreenConnect.ClientSetup (1).exe.d5db8.2.raw.unpackJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                            0.2.ScreenConnect.ClientSetup (1).exe.5cc0000.7.unpackJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                              Click to see the 3 entries

                              Sigma Signatures

                              System Summary

                              barindex
                              Sigma detected: Remote Access Tool - ScreenConnect Suspicious Execution
                              Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-f13iq7-relay.screenconnect.com&p=443&s=8c4565db-ac67-42c5-9630-9aa3f157ab83&k=BgIAAACkAABSU0ExAAgAAAEAAQC1MY9w4B1kmCI8rrVVcN3Qv2pF2incNEaC5%2f57%2frQys%2fxWV8jitTHxen5sI4Wll36RpM9KV99bb78RmSViUCckbjE5KmpupWzSRQPRoXSxvLn2bqJ43r%2b0c1Xzj6wxUS%2bGCdb3y5osDTbAX4izwcSX%2fWd5MibcXFXyV0GDsYs7uPqQNXSNtw1v5PTrV4hH6KEn7iG8xD119OfXklw0j4quXgapgwpI4dZ5E20CIMcRqfPC5dqnBzSKD%2bnQ0l48Ao%2fzM5ObrNV%2f8giwIObi%2f%2b9H0BQvztiy4rypOySEqrH3oVDeR1OWmdV0FGCTguAa5uyNJoKXRLqK4n1ztMQHr%2f%2bi&c=Van%20Buren%20Telephone%20Company&c=&c=&c=&c=&c=&c=&c=", CommandLine: "C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-f13iq7-relay.screenconnect.com&p=443&s=8c4565db-ac67-42c5-9630-9aa3f157ab83&k=BgIAAACkAABSU0ExAAgAAAEAAQC1MY9w4B1kmCI8rrVVcN3Qv2pF2incNEaC5%2f57%2frQys%2fxWV8jitTHxen5sI4Wll36RpM9KV99bb78RmSViUCckbjE5KmpupWzSRQPRoXSxvLn2bqJ43r%2b0c1Xzj6wxUS%2bGCdb3y5osDTbAX4izwcSX%2fWd5MibcXFXyV0GDsYs7uPqQNXSNtw1v5PTrV4hH6KEn7iG8xD119OfXklw0j4quXgapgwpI4dZ5E20CIMcRqfPC5dqnBzSKD%2bnQ0l48Ao%2fzM5ObrNV%2f8giwIObi%2f%2b9H0BQvztiy4rypOySEqrH3oVDeR1OWmdV0FGCTguAa5uyNJoKXRLqK4n1ztMQHr%2f%2bi&c=Van%20Buren%20Telephone%20Company&c=&c=&c=&c=&c=&c=&c=", CommandLine|base64offset|contains: )^, Image: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exe, NewProcessName: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exe, OriginalFileName: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: "C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-f13iq7-relay.screenconnect.com&p=443&s=8c4565db-ac67-42c5-9630-9aa3f157ab83&k=BgIAAACkAABSU0ExAAgAAAEAAQC1MY9w4B1kmCI8rrVVcN3Qv2pF2incNEaC5%2f57%2frQys%2fxWV8jitTHxen5sI4Wll36RpM9KV99bb78RmSViUCckbjE5KmpupWzSRQPRoXSxvLn2bqJ43r%2b0c1Xzj6wxUS%2bGCdb3y5osDTbAX4izwcSX%2fWd5MibcXFXyV0GDsYs7uPqQNXSNtw1v5PTrV4hH6KEn7iG8xD119OfXklw0j4quXgapgwpI4dZ5E20CIMcRqfPC5dqnBzSKD%2bnQ0l48Ao%2fzM5ObrNV%2f8giwIObi%2f%2b9H0BQvztiy4rypOySEqrH3oVDeR1OWmdV0FGCTguAa5uyNJoKXRLqK4n1ztMQHr%2f%2bi&c=Van%20Buren%20Telephone%20Company&c=&c=&c=&c=&c=&c=&c=", ProcessId: 1372, ProcessName: ScreenConnect.ClientService.exe
                              Sigma detected: Windows Processes Suspicious Parent Directory
                              Source: Process startedAuthor: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3080, ProcessName: svchost.exe

                              Suricata Signatures

                              ⊘No Suricata rule has matched

                              Joe Sandbox Signatures

                              Click to jump to signature section

                              Show All Signature Results

                              AV Detection

                              barindex
                              AI detected suspicious sample
                              Source: Submited SampleIntegrated Neural Analysis Model: Matched 97.6% probability
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeCode function: 8_2_04480F08 CryptProtectData,8_2_04480F08
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeCode function: 8_2_044816F1 CryptProtectData,8_2_044816F1
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeEXE: msiexec.exeJump to behavior

                              Compliance

                              barindex
                              EXE planting / hijacking vulnerabilities found
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeEXE: msiexec.exeJump to behavior
                              Uses 32bit PE files
                              Source: ScreenConnect.ClientSetup (1).exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                              Creates install or setup log file
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ScreenConnect.ClientSetup (1).exe.logJump to behavior
                              PE / OLE file has a valid certificate
                              Source: ScreenConnect.ClientSetup (1).exeStatic PE information: certificate valid
                              Contains modern PE file flags such as dynamic base (ASLR) or NX
                              Source: ScreenConnect.ClientSetup (1).exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                              Binary contains paths to debug symbols
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb source: ScreenConnect.WindowsFileManager.exe.3.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdbU source: ScreenConnect.ClientService.exe, 00000008.00000002.3409815361.0000000005432000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.3397384984.000000001B0F2000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Client.dll.3.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdbe source: ScreenConnect.WindowsClient.exe, 00000009.00000000.2182692087.0000000000622000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.WindowsClient.exe.3.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsInstaller\obj\Release\net20\ScreenConnect.WindowsInstaller.pdbM source: ScreenConnect.ClientSetup (1).exe
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientInstallerRunner\obj\Release\ScreenConnect.ClientInstallerRunner.pdb source: ScreenConnect.ClientSetup (1).exe
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsInstaller\obj\Release\net20\ScreenConnect.WindowsInstaller.pdb source: ScreenConnect.ClientSetup (1).exe
                              Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdbT source: Microsoft.Deployment.WindowsInstaller.dll.5.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.3.dr
                              Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller.Package\Microsoft.Deployment.WindowsInstaller.Package.pdb source: Microsoft.Deployment.WindowsInstaller.Package.dll.5.dr
                              Source: Binary string: C:\Compile\screenconnect\Product\WindowsAuthenticationPackage\bin\Release\ScreenConnect.WindowsAuthenticationPackage.pdb source: ScreenConnect.ClientService.exe, 00000008.00000002.3399065813.0000000003057000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.3394601582.0000000012830000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: ScreenConnect.ClientSetup (1).exe, ScreenConnect.Core.dll.5.dr, ScreenConnect.Core.dll.3.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: ScreenConnect.WindowsClient.exe, 00000009.00000002.3383842926.00000000026E0000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.3397910203.000000001B152000.00000002.00000001.01000000.0000000D.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.3384013467.0000000002821000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.dll.3.dr
                              Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\DotNetResolver\obj\Debug\DotNetResolver.pdb source: ScreenConnect.ClientSetup (1).exe
                              Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 00000008.00000000.2170977883.000000000010D000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.ClientService.exe.3.dr
                              Source: Binary string: mscorlib.pdb source: ScreenConnect.ClientService.exe, 00000008.00000002.3409815361.0000000005432000.00000004.00000020.00020000.00000000.sdmp
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: ScreenConnect.ClientSetup (1).exe, ScreenConnect.Windows.dll.5.dr, ScreenConnect.Windows.dll.3.dr
                              Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\Compression.Cab\Microsoft.Deployment.Compression.Cab.pdb source: rundll32.exe, 00000005.00000003.2154072642.0000000004E00000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2151662935.0000000004F83000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.Cab.dll.5.dr
                              Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdb source: Microsoft.Deployment.WindowsInstaller.dll.5.dr
                              Source: Binary string: C:\build\work\eca3d12b\wix3\build\ship\x86\wixca.pdb source: ScreenConnect.ClientSetup (1).exe, 6ed327.msi.3.dr, MSID52B.tmp.3.dr, MSID7CD.tmp.3.dr, 6ed328.rbs.3.dr, setup.msi.0.dr, 6ed329.msi.3.dr, MSID53B.tmp.3.dr
                              Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\Compression\Microsoft.Deployment.Compression.pdb source: rundll32.exe, 00000005.00000003.2151662935.0000000004F14000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.dll.5.dr
                              Source: Binary string: screenconnect_windows_credential_provider.pdb source: ScreenConnect.ClientService.exe, 00000008.00000002.3399065813.0000000003057000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.3394601582.0000000012830000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsCredentialProvider.dll.3.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000009.00000000.2182692087.0000000000622000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.WindowsClient.exe.3.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\InstallerActions\obj\Release\ScreenConnect.InstallerActions.pdb source: ScreenConnect.InstallerActions.dll.5.dr
                              Source: Binary string: E:\delivery\Dev\wix37_public\build\ship\x86\SfxCA.pdb source: ScreenConnect.ClientSetup (1).exe, 6ed327.msi.3.dr, MSICF5E.tmp.2.dr, setup.msi.0.dr, 6ed329.msi.3.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdbW] source: ScreenConnect.ClientSetup (1).exe, ScreenConnect.Windows.dll.5.dr, ScreenConnect.Windows.dll.3.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: ScreenConnect.ClientService.exe, 00000008.00000002.3409815361.0000000005432000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.3397384984.000000001B0F2000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Client.dll.3.dr
                              Source: Binary string: screenconnect_windows_credential_provider.pdb' source: ScreenConnect.ClientService.exe, 00000008.00000002.3399065813.0000000003057000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.3394601582.0000000012830000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsCredentialProvider.dll.3.dr
                              Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetRunner.pdb source: ScreenConnect.ClientSetup (1).exe
                              Source: C:\Windows\System32\msiexec.exeFile opened: z:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: x:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: v:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: t:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: r:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: p:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: n:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: l:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: j:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: h:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: f:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: b:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: y:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: w:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: u:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: s:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: q:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: o:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: m:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: k:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: i:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: g:Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile opened: e:Jump to behavior
                              Source: C:\Windows\System32\svchost.exeFile opened: c:
                              Source: C:\Windows\System32\msiexec.exeFile opened: a:Jump to behavior

                              Networking

                              barindex
                              Enables network access during safeboot for specific services
                              Source: C:\Windows\System32\msiexec.exeRegistry value created: NULL ServiceJump to behavior
                              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                              Source: global trafficDNS traffic detected: DNS query: instance-f13iq7-relay.screenconnect.com
                              Source: ScreenConnect.ClientSetup (1).exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr, ScreenConnect.WindowsBackstageShell.exe.3.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
                              Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.3394601582.0000000012830000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientSetup (1).exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr, ScreenConnect.WindowsBackstageShell.exe.3.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
                              Source: ScreenConnect.ClientSetup (1).exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr, ScreenConnect.WindowsBackstageShell.exe.3.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
                              Source: ScreenConnect.ClientSetup (1).exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr, ScreenConnect.WindowsBackstageShell.exe.3.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
                              Source: svchost.exe, 0000000A.00000002.3383232377.00000161BEA85000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.ver)
                              Source: ScreenConnect.ClientSetup (1).exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr, ScreenConnect.WindowsBackstageShell.exe.3.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
                              Source: ScreenConnect.ClientSetup (1).exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr, ScreenConnect.WindowsBackstageShell.exe.3.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
                              Source: ScreenConnect.ClientSetup (1).exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr, ScreenConnect.WindowsBackstageShell.exe.3.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
                              Source: ScreenConnect.WindowsBackstageShell.exe.3.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
                              Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.3394601582.0000000012830000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientSetup (1).exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr, ScreenConnect.WindowsBackstageShell.exe.3.drString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
                              Source: qmgr.db.10.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
                              Source: qmgr.db.10.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
                              Source: qmgr.db.10.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
                              Source: qmgr.db.10.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
                              Source: qmgr.db.10.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
                              Source: qmgr.db.10.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
                              Source: qmgr.db.10.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
                              Source: qmgr.db.10.drString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
                              Source: ScreenConnect.ClientService.exe, 00000008.00000002.3381913415.0000000001411000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://instance-f13iq7-relay.screenconnect.com:443/O
                              Source: ScreenConnect.ClientService.exe, 00000008.00000002.3385079129.00000000022CA000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.3385079129.0000000002204000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.3385079129.0000000002275000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.3385079129.00000000024E9000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.3385079129.000000000240B000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.3385079129.00000000020B2000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.3385079129.000000000234F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://instance-f13iq7-relay.screenconnect.com:443/d
                              Source: ScreenConnect.ClientSetup (1).exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr, ScreenConnect.WindowsBackstageShell.exe.3.drString found in binary or memory: http://ocsp.digicert.com0
                              Source: ScreenConnect.ClientSetup (1).exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr, ScreenConnect.WindowsBackstageShell.exe.3.drString found in binary or memory: http://ocsp.digicert.com0A
                              Source: ScreenConnect.ClientSetup (1).exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr, ScreenConnect.WindowsBackstageShell.exe.3.drString found in binary or memory: http://ocsp.digicert.com0C
                              Source: ScreenConnect.ClientSetup (1).exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr, ScreenConnect.WindowsBackstageShell.exe.3.drString found in binary or memory: http://ocsp.digicert.com0X
                              Source: ScreenConnect.ClientSetup (1).exe, 00000000.00000002.2149354887.00000000034C1000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.3385079129.00000000020B2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                              Source: rundll32.exe, 00000005.00000003.2151662935.0000000004F14000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2151662935.0000000004F83000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2151835205.0000000004E03000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.Cab.dll.5.dr, Microsoft.Deployment.Compression.dll.5.dr, Microsoft.Deployment.WindowsInstaller.dll.5.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.5.drString found in binary or memory: http://wixtoolset.org/Whttp://wixtoolset.org/telemetry/v
                              Source: rundll32.exe, 00000005.00000003.2151662935.0000000004F14000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2151662935.0000000004F83000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2151835205.0000000004E03000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.Cab.dll.5.dr, Microsoft.Deployment.Compression.dll.5.dr, Microsoft.Deployment.WindowsInstaller.dll.5.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.5.drString found in binary or memory: http://wixtoolset.org/news/
                              Source: rundll32.exe, 00000005.00000003.2151662935.0000000004F14000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2151662935.0000000004F83000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2151835205.0000000004E03000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.Cab.dll.5.dr, Microsoft.Deployment.Compression.dll.5.dr, Microsoft.Deployment.WindowsInstaller.dll.5.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.5.drString found in binary or memory: http://wixtoolset.org/releases/
                              Source: ScreenConnect.ClientSetup (1).exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr, ScreenConnect.WindowsBackstageShell.exe.3.drString found in binary or memory: http://www.digicert.com/CPS0
                              Source: ScreenConnect.WindowsCredentialProvider.dll.3.drString found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
                              Source: ScreenConnect.Core.dll.3.drString found in binary or memory: https://feedback.screenconnect.com/Feedback.axd
                              Source: qmgr.db.10.drString found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
                              Source: svchost.exe, 0000000A.00000003.2204288342.00000161BE950000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.drString found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723

                              Spam, unwanted Advertisements and Ransom Demands

                              barindex
                              Reads the Security eventlog
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\ScreenConnectJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\ScreenConnectJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                              Reads the System eventlog
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\ScreenConnectJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\ScreenConnectJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeCode function: 8_2_05E42280 CreateProcessAsUserW,8_2_05E42280
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\6ed327.msiJump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\inprogressinstallinfo.ipiJump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\SourceHash{7C192981-00FA-4F6A-CC5D-8D3B0AD966AA}Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSID52B.tmpJump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSID53B.tmpJump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSID7CD.tmpJump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\6ed329.msiJump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\6ed329.msiJump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\{7C192981-00FA-4F6A-CC5D-8D3B0AD966AA}Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\{7C192981-00FA-4F6A-CC5D-8D3B0AD966AA}\DefaultIconJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeFile created: C:\Windows\Installer\wix{7C192981-00FA-4F6A-CC5D-8D3B0AD966AA}.SchedServiceConfig.rmiJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ccf23f1afa8af061)Jump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ccf23f1afa8af061)\4mlziiez.tmpJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ccf23f1afa8af061)\4mlziiez.newcfgJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ccf23f1afa8af061)\ndtrnucs.tmpJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ccf23f1afa8af061)\ndtrnucs.newcfgJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ccf23f1afa8af061)\hldinm0o.tmpJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ccf23f1afa8af061)\hldinm0o.newcfgJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ccf23f1afa8af061)\ledwk0ar.tmpJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ccf23f1afa8af061)\ledwk0ar.newcfgJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ccf23f1afa8af061)\ou2zxzr5.tmpJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ccf23f1afa8af061)\ou2zxzr5.newcfgJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ccf23f1afa8af061)\snbxiz2y.tmpJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ccf23f1afa8af061)\snbxiz2y.newcfgJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ccf23f1afa8af061)\nhkn5cft.tmpJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ccf23f1afa8af061)\nhkn5cft.newcfgJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ccf23f1afa8af061)\5im4yx0k.tmpJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ccf23f1afa8af061)\5im4yx0k.newcfgJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ccf23f1afa8af061)\fnbyy2ll.tmpJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ccf23f1afa8af061)\fnbyy2ll.newcfgJump to behavior
                              Source: C:\Windows\System32\svchost.exeFile created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
                              Source: C:\Windows\System32\msiexec.exeFile deleted: C:\Windows\Installer\MSID53B.tmpJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeCode function: 0_2_05C2F0A30_2_05C2F0A3
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeCode function: 0_2_05C26F000_2_05C26F00
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeCode function: 0_2_05C29F000_2_05C29F00
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeCode function: 0_2_05C260C00_2_05C260C0
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeCode function: 0_2_05C26EF10_2_05C26EF1
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeCode function: 0_2_05C4039B0_2_05C4039B
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeCode function: 8_2_01E3D5888_2_01E3D588
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeCode function: 8_2_05E400408_2_05E40040
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeCode function: 8_2_05E400408_2_05E40040
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD342D71389_2_00007FFD342D7138
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD343073009_2_00007FFD34307300
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD342DDCD39_2_00007FFD342DDCD3
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD342DEE0D9_2_00007FFD342DEE0D
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD342DEEC09_2_00007FFD342DEEC0
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD342E27559_2_00007FFD342E2755
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD342D10D79_2_00007FFD342D10D7
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD342D10CF9_2_00007FFD342D10CF
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD342E29D39_2_00007FFD342E29D3
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD342DD2409_2_00007FFD342DD240
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD342DDB859_2_00007FFD342DDB85
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD342DDBD39_2_00007FFD342DDBD3
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD345E65319_2_00007FFD345E6531
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD345E76F29_2_00007FFD345E76F2
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD345E000A9_2_00007FFD345E000A
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD345E08779_2_00007FFD345E0877
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD345F00E09_2_00007FFD345F00E0
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD345F2CFA9_2_00007FFD345F2CFA
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD345E08F29_2_00007FFD345E08F2
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD345EF4F29_2_00007FFD345EF4F2
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD345F2DD39_2_00007FFD345F2DD3
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD345EE5889_2_00007FFD345EE588
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD345E9A289_2_00007FFD345E9A28
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD345E05F99_2_00007FFD345E05F9
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD345F25F29_2_00007FFD345F25F2
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD345F26D39_2_00007FFD345F26D3
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD345F16D09_2_00007FFD345F16D0
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD345E9F269_2_00007FFD345E9F26
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD345EB30D9_2_00007FFD345EB30D
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD345EEEFA9_2_00007FFD345EEEFA
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeCode function: 9_2_00007FFD345EC7689_2_00007FFD345EC768
                              Source: ScreenConnect.ClientSetup (1).exeStatic PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                              Source: ScreenConnect.ClientSetup (1).exeStatic PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                              Source: ScreenConnect.ClientSetup (1).exeStatic PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                              Source: ScreenConnect.ClientSetup (1).exeStatic PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                              Source: ScreenConnect.ClientSetup (1).exeStatic PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                              Source: ScreenConnect.ClientSetup (1).exe, 00000000.00000002.2153260168.0000000005A50000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenamelibwebp.dllB vs ScreenConnect.ClientSetup (1).exe
                              Source: ScreenConnect.ClientSetup (1).exe, 00000000.00000002.2153260168.0000000005A50000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenamezlib.dll2 vs ScreenConnect.ClientSetup (1).exe
                              Source: ScreenConnect.ClientSetup (1).exe, 00000000.00000002.2153260168.0000000005A50000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameScreenConnect.Windows.dll< vs ScreenConnect.ClientSetup (1).exe
                              Source: ScreenConnect.ClientSetup (1).exe, 00000000.00000002.2155563654.0000000005E7C000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameScreenConnect.InstallerActions.dll< vs ScreenConnect.ClientSetup (1).exe
                              Source: ScreenConnect.ClientSetup (1).exe, 00000000.00000002.2155563654.0000000005E7C000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameSfxCA.dllL vs ScreenConnect.ClientSetup (1).exe
                              Source: ScreenConnect.ClientSetup (1).exe, 00000000.00000002.2155563654.0000000005E7C000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenamewixca.dll\ vs ScreenConnect.ClientSetup (1).exe
                              Source: ScreenConnect.ClientSetup (1).exe, 00000000.00000002.2155563654.0000000005E7C000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameScreenConnect.ClientInstallerRunner.exe< vs ScreenConnect.ClientSetup (1).exe
                              Source: ScreenConnect.ClientSetup (1).exe, 00000000.00000002.2148352142.0000000003460000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameScreenConnect.WindowsInstaller.dll< vs ScreenConnect.ClientSetup (1).exe
                              Source: ScreenConnect.ClientSetup (1).exe, 00000000.00000000.2128643109.000000000054F000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameScreenConnect.ClientInstallerRunner.exe< vs ScreenConnect.ClientSetup (1).exe
                              Source: ScreenConnect.ClientSetup (1).exe, 00000000.00000000.2128643109.000000000054F000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameDotNetResolver.exe4 vs ScreenConnect.ClientSetup (1).exe
                              Source: ScreenConnect.ClientSetup (1).exe, 00000000.00000002.2147329762.00000000032D0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameDotNetResolver.exe4 vs ScreenConnect.ClientSetup (1).exe
                              Source: ScreenConnect.ClientSetup (1).exe, 00000000.00000002.2152802882.00000000059C0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameScreenConnect.Core.dll< vs ScreenConnect.ClientSetup (1).exe
                              Source: ScreenConnect.ClientSetup (1).exe, 00000000.00000002.2157913758.0000000007FBD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewixca.dll\ vs ScreenConnect.ClientSetup (1).exe
                              Source: ScreenConnect.ClientSetup (1).exe, 00000000.00000002.2151524291.0000000004683000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameScreenConnect.Windows.dll< vs ScreenConnect.ClientSetup (1).exe
                              Source: ScreenConnect.ClientSetup (1).exe, 00000000.00000002.2157753753.0000000007030000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemsiexec.exeX vs ScreenConnect.ClientSetup (1).exe
                              Source: ScreenConnect.ClientSetup (1).exe, 00000000.00000000.2128643109.0000000000026000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameScreenConnect.Core.dll< vs ScreenConnect.ClientSetup (1).exe
                              Source: ScreenConnect.ClientSetup (1).exe, 00000000.00000000.2128643109.0000000000026000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamelibwebp.dllB vs ScreenConnect.ClientSetup (1).exe
                              Source: ScreenConnect.ClientSetup (1).exe, 00000000.00000000.2128643109.0000000000026000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamezlib.dll2 vs ScreenConnect.ClientSetup (1).exe
                              Source: ScreenConnect.ClientSetup (1).exe, 00000000.00000000.2128643109.0000000000026000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameScreenConnect.Windows.dll< vs ScreenConnect.ClientSetup (1).exe
                              Source: ScreenConnect.ClientSetup (1).exe, 00000000.00000000.2128643109.0000000000026000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameScreenConnect.WindowsInstaller.dll< vs ScreenConnect.ClientSetup (1).exe
                              Source: ScreenConnect.ClientSetup (1).exeBinary or memory string: OriginalFilenameScreenConnect.Core.dll< vs ScreenConnect.ClientSetup (1).exe
                              Source: ScreenConnect.ClientSetup (1).exeBinary or memory string: OriginalFilenamelibwebp.dllB vs ScreenConnect.ClientSetup (1).exe
                              Source: ScreenConnect.ClientSetup (1).exeBinary or memory string: OriginalFilenamezlib.dll2 vs ScreenConnect.ClientSetup (1).exe
                              Source: ScreenConnect.ClientSetup (1).exeBinary or memory string: OriginalFilenameScreenConnect.Windows.dll< vs ScreenConnect.ClientSetup (1).exe
                              Source: ScreenConnect.ClientSetup (1).exeBinary or memory string: OriginalFilenameScreenConnect.WindowsInstaller.dll< vs ScreenConnect.ClientSetup (1).exe
                              Source: ScreenConnect.ClientSetup (1).exeBinary or memory string: OriginalFilenameScreenConnect.InstallerActions.dll< vs ScreenConnect.ClientSetup (1).exe
                              Source: ScreenConnect.ClientSetup (1).exeBinary or memory string: OriginalFilenameSfxCA.dllL vs ScreenConnect.ClientSetup (1).exe
                              Source: ScreenConnect.ClientSetup (1).exeBinary or memory string: OriginalFilenamewixca.dll\ vs ScreenConnect.ClientSetup (1).exe
                              Source: ScreenConnect.ClientSetup (1).exeBinary or memory string: OriginalFilenameScreenConnect.ClientInstallerRunner.exe< vs ScreenConnect.ClientSetup (1).exe
                              Source: ScreenConnect.ClientSetup (1).exeBinary or memory string: OriginalFilenameDotNetResolver.exe4 vs ScreenConnect.ClientSetup (1).exe
                              Source: ScreenConnect.ClientSetup (1).exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                              Source: 0.0.ScreenConnect.ClientSetup (1).exe.263d8.3.raw.unpack, CursorBuffer.csCryptographic APIs: 'TransformBlock'
                              Source: 0.2.ScreenConnect.ClientSetup (1).exe.5a50000.3.raw.unpack, WindowsToolkit.csCryptographic APIs: 'CreateDecryptor'
                              Source: 0.0.ScreenConnect.ClientSetup (1).exe.ac3d8.5.raw.unpack, WindowsToolkit.csCryptographic APIs: 'CreateDecryptor'
                              Source: 0.2.ScreenConnect.ClientSetup (1).exe.59c0000.2.raw.unpack, CursorBuffer.csCryptographic APIs: 'TransformBlock'
                              Source: 0.2.ScreenConnect.ClientSetup (1).exe.5a50000.3.raw.unpack, WindowsExtensions.csSecurity API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
                              Source: 0.2.ScreenConnect.ClientSetup (1).exe.5a50000.3.raw.unpack, WindowsExtensions.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                              Source: 0.2.ScreenConnect.ClientSetup (1).exe.5a50000.3.raw.unpack, WindowsExtensions.csSecurity API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
                              Source: 0.0.ScreenConnect.ClientSetup (1).exe.ac3d8.5.raw.unpack, WindowsExtensions.csSecurity API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
                              Source: 0.0.ScreenConnect.ClientSetup (1).exe.ac3d8.5.raw.unpack, WindowsExtensions.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                              Source: 0.0.ScreenConnect.ClientSetup (1).exe.ac3d8.5.raw.unpack, WindowsExtensions.csSecurity API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
                              Source: classification engineClassification label: mal57.evad.winEXE@16/65@3/2
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)Jump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ScreenConnect.ClientSetup (1).exe.logJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeMutant created: NULL
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeMutant created: \BaseNamedObjects\Global\netfxeventlog.1.0
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeFile created: C:\Users\user\AppData\Local\Temp\ScreenConnectJump to behavior
                              Source: ScreenConnect.ClientSetup (1).exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                              Source: ScreenConnect.ClientSetup (1).exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSICF5E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_7262203 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                              Source: ScreenConnect.ClientSetup (1).exeString found in binary or memory: $F294ACFC-3146-4483-A7BF-ADDCA7C260E2
                              Source: ScreenConnect.ClientSetup (1).exeString found in binary or memory: $F294ACFC-3146-4483-A7BF-ADDCA7C260E2)
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeFile read: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeJump to behavior
                              Source: unknownProcess created: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exe "C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exe"
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeProcess created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ScreenConnect\ccf23f1afa8af061\setup.msi"
                              Source: unknownProcess created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
                              Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding BC108F69163DAA59A6F9981178743870 C
                              Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSICF5E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_7262203 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                              Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding CCDB78175ACA179D0D189E42F6A15F79
                              Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 644E16E75658CB40C644CEA9BB61A5D0 E Global\MSI0000
                              Source: unknownProcess created: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exe "C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-f13iq7-relay.screenconnect.com&p=443&s=8c4565db-ac67-42c5-9630-9aa3f157ab83&k=BgIAAACkAABSU0ExAAgAAAEAAQC1MY9w4B1kmCI8rrVVcN3Qv2pF2incNEaC5%2f57%2frQys%2fxWV8jitTHxen5sI4Wll36RpM9KV99bb78RmSViUCckbjE5KmpupWzSRQPRoXSxvLn2bqJ43r%2b0c1Xzj6wxUS%2bGCdb3y5osDTbAX4izwcSX%2fWd5MibcXFXyV0GDsYs7uPqQNXSNtw1v5PTrV4hH6KEn7iG8xD119OfXklw0j4quXgapgwpI4dZ5E20CIMcRqfPC5dqnBzSKD%2bnQ0l48Ao%2fzM5ObrNV%2f8giwIObi%2f%2b9H0BQvztiy4rypOySEqrH3oVDeR1OWmdV0FGCTguAa5uyNJoKXRLqK4n1ztMQHr%2f%2bi&c=Van%20Buren%20Telephone%20Company&c=&c=&c=&c=&c=&c=&c="
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess created: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exe "C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exe" "RunRole" "45494334-b96f-4a01-b0ee-df000a95fbae" "User"
                              Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeProcess created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ScreenConnect\ccf23f1afa8af061\setup.msi"Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding BC108F69163DAA59A6F9981178743870 CJump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding CCDB78175ACA179D0D189E42F6A15F79Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 644E16E75658CB40C644CEA9BB61A5D0 E Global\MSI0000Jump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSICF5E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_7262203 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArgumentsJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess created: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exe "C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exe" "RunRole" "45494334-b96f-4a01-b0ee-df000a95fbae" "User"Jump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeSection loaded: apphelp.dllJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeSection loaded: mscoree.dllJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeSection loaded: wldp.dllJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeSection loaded: amsi.dllJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeSection loaded: userenv.dllJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeSection loaded: profapi.dllJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeSection loaded: version.dllJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeSection loaded: msasn1.dllJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeSection loaded: gpapi.dllJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeSection loaded: cryptsp.dllJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeSection loaded: rsaenh.dllJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeSection loaded: cryptbase.dllJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeSection loaded: uxtheme.dllJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeSection loaded: windows.storage.dllJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeSection loaded: propsys.dllJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeSection loaded: edputil.dllJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeSection loaded: urlmon.dllJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeSection loaded: iertutil.dllJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeSection loaded: srvcli.dllJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeSection loaded: netutils.dllJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeSection loaded: windows.staterepositoryps.dllJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeSection loaded: sspicli.dllJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeSection loaded: wintypes.dllJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeSection loaded: appresolver.dllJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeSection loaded: bcp47langs.dllJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeSection loaded: slc.dllJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeSection loaded: sppc.dllJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeSection loaded: onecorecommonproxystub.dllJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: apphelp.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: aclayers.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mpr.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msi.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: srpapi.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: tsappcmp.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: uxtheme.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: textinputframework.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: coreuicomponents.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: coremessaging.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: ntmarta.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wintypes.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wintypes.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wintypes.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: windows.storage.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wldp.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: propsys.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: textshaping.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: netapi32.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wkscli.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: netutils.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: version.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mscoree.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: profapi.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sspicli.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msihnd.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: pcacli.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: apphelp.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: aclayers.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: sfc.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: msi.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: tsappcmp.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: userenv.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: profapi.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: sspicli.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: netapi32.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: wkscli.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: netutils.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: srclient.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: spp.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: powrprof.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: vssapi.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: vsstrace.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: umpdc.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: wldp.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: mscoree.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: version.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: rstrtmgr.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: ncrypt.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: ntasn1.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: windows.storage.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: pcacli.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: mpr.dllJump to behavior
                              Source: C:\Windows\System32\msiexec.exeSection loaded: cabinet.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: apphelp.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: aclayers.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mpr.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msi.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: cabinet.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: apphelp.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: aclayers.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mpr.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msi.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: version.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: apphelp.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: aclayers.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mpr.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msi.dllJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: version.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: apphelp.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: mscoree.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: cryptsp.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: rsaenh.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: cryptbase.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: urlmon.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: iertutil.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: srvcli.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: netutils.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: sspicli.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: windows.storage.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: wldp.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: propsys.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: version.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: profapi.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: dpapi.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: amsi.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: userenv.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: msasn1.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: gpapi.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: wtsapi32.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: winsta.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: netapi32.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: samcli.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: samlib.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: mswsock.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: dnsapi.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: iphlpapi.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: rasadhlp.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: fwpuclnt.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: dhcpcsvc6.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: dhcpcsvc.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: winnsi.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: rasapi32.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: rasman.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: rtutils.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: winhttp.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: ntmarta.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeSection loaded: mscoree.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeSection loaded: apphelp.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeSection loaded: version.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeSection loaded: uxtheme.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeSection loaded: cryptsp.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeSection loaded: rsaenh.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeSection loaded: cryptbase.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeSection loaded: windows.storage.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeSection loaded: wldp.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeSection loaded: profapi.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeSection loaded: amsi.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeSection loaded: userenv.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeSection loaded: urlmon.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeSection loaded: iertutil.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeSection loaded: srvcli.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeSection loaded: netutils.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeSection loaded: sspicli.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeSection loaded: propsys.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeSection loaded: windowscodecs.dllJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeSection loaded: dwrite.dllJump to behavior
                              Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: qmgr.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: bitsperf.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: firewallapi.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: esent.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: dnsapi.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: iphlpapi.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: fwbase.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: flightsettings.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: netprofm.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: bitsigd.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: upnp.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: ssdpapi.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: urlmon.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: iertutil.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: srvcli.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: appxdeploymentclient.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: wsmauto.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: miutils.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: wsmsvc.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: dsrole.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: pcwum.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: mi.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: gpapi.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: wkscli.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: msv1_0.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: ntlmshared.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: cryptdll.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: webio.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: mswsock.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: winnsi.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: rasadhlp.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: fwpuclnt.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: rmclient.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: usermgrcli.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: execmodelclient.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: propsys.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: coremessaging.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: twinapi.appcore.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: onecorecommonproxystub.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: execmodelproxy.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: resourcepolicyclient.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: vssapi.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: vsstrace.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: samcli.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: samlib.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: es.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: bitsproxy.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc6.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: schannel.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: mskeyprotect.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: ntasn1.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: ncrypt.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: ncryptsslp.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: msasn1.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: rsaenh.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: dpapi.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: mpr.dll
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
                              Source: Window RecorderWindow detected: More than 3 window changes detected
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                              Source: ScreenConnect.ClientSetup (1).exeStatic PE information: certificate valid
                              Source: ScreenConnect.ClientSetup (1).exeStatic file information: File size 5621320 > 1048576
                              Source: ScreenConnect.ClientSetup (1).exeStatic PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x533200
                              Source: ScreenConnect.ClientSetup (1).exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
                              Source: ScreenConnect.ClientSetup (1).exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
                              Source: ScreenConnect.ClientSetup (1).exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
                              Source: ScreenConnect.ClientSetup (1).exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                              Source: ScreenConnect.ClientSetup (1).exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
                              Source: ScreenConnect.ClientSetup (1).exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
                              Source: ScreenConnect.ClientSetup (1).exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                              Source: ScreenConnect.ClientSetup (1).exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb source: ScreenConnect.WindowsFileManager.exe.3.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdbU source: ScreenConnect.ClientService.exe, 00000008.00000002.3409815361.0000000005432000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.3397384984.000000001B0F2000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Client.dll.3.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdbe source: ScreenConnect.WindowsClient.exe, 00000009.00000000.2182692087.0000000000622000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.WindowsClient.exe.3.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsInstaller\obj\Release\net20\ScreenConnect.WindowsInstaller.pdbM source: ScreenConnect.ClientSetup (1).exe
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientInstallerRunner\obj\Release\ScreenConnect.ClientInstallerRunner.pdb source: ScreenConnect.ClientSetup (1).exe
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsInstaller\obj\Release\net20\ScreenConnect.WindowsInstaller.pdb source: ScreenConnect.ClientSetup (1).exe
                              Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdbT source: Microsoft.Deployment.WindowsInstaller.dll.5.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.3.dr
                              Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller.Package\Microsoft.Deployment.WindowsInstaller.Package.pdb source: Microsoft.Deployment.WindowsInstaller.Package.dll.5.dr
                              Source: Binary string: C:\Compile\screenconnect\Product\WindowsAuthenticationPackage\bin\Release\ScreenConnect.WindowsAuthenticationPackage.pdb source: ScreenConnect.ClientService.exe, 00000008.00000002.3399065813.0000000003057000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.3394601582.0000000012830000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: ScreenConnect.ClientSetup (1).exe, ScreenConnect.Core.dll.5.dr, ScreenConnect.Core.dll.3.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: ScreenConnect.WindowsClient.exe, 00000009.00000002.3383842926.00000000026E0000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.3397910203.000000001B152000.00000002.00000001.01000000.0000000D.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.3384013467.0000000002821000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.dll.3.dr
                              Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\DotNetResolver\obj\Debug\DotNetResolver.pdb source: ScreenConnect.ClientSetup (1).exe
                              Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 00000008.00000000.2170977883.000000000010D000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.ClientService.exe.3.dr
                              Source: Binary string: mscorlib.pdb source: ScreenConnect.ClientService.exe, 00000008.00000002.3409815361.0000000005432000.00000004.00000020.00020000.00000000.sdmp
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: ScreenConnect.ClientSetup (1).exe, ScreenConnect.Windows.dll.5.dr, ScreenConnect.Windows.dll.3.dr
                              Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\Compression.Cab\Microsoft.Deployment.Compression.Cab.pdb source: rundll32.exe, 00000005.00000003.2154072642.0000000004E00000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2151662935.0000000004F83000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.Cab.dll.5.dr
                              Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdb source: Microsoft.Deployment.WindowsInstaller.dll.5.dr
                              Source: Binary string: C:\build\work\eca3d12b\wix3\build\ship\x86\wixca.pdb source: ScreenConnect.ClientSetup (1).exe, 6ed327.msi.3.dr, MSID52B.tmp.3.dr, MSID7CD.tmp.3.dr, 6ed328.rbs.3.dr, setup.msi.0.dr, 6ed329.msi.3.dr, MSID53B.tmp.3.dr
                              Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\Compression\Microsoft.Deployment.Compression.pdb source: rundll32.exe, 00000005.00000003.2151662935.0000000004F14000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.dll.5.dr
                              Source: Binary string: screenconnect_windows_credential_provider.pdb source: ScreenConnect.ClientService.exe, 00000008.00000002.3399065813.0000000003057000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.3394601582.0000000012830000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsCredentialProvider.dll.3.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000009.00000000.2182692087.0000000000622000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.WindowsClient.exe.3.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\InstallerActions\obj\Release\ScreenConnect.InstallerActions.pdb source: ScreenConnect.InstallerActions.dll.5.dr
                              Source: Binary string: E:\delivery\Dev\wix37_public\build\ship\x86\SfxCA.pdb source: ScreenConnect.ClientSetup (1).exe, 6ed327.msi.3.dr, MSICF5E.tmp.2.dr, setup.msi.0.dr, 6ed329.msi.3.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdbW] source: ScreenConnect.ClientSetup (1).exe, ScreenConnect.Windows.dll.5.dr, ScreenConnect.Windows.dll.3.dr
                              Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: ScreenConnect.ClientService.exe, 00000008.00000002.3409815361.0000000005432000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.3397384984.000000001B0F2000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Client.dll.3.dr
                              Source: Binary string: screenconnect_windows_credential_provider.pdb' source: ScreenConnect.ClientService.exe, 00000008.00000002.3399065813.0000000003057000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000009.00000002.3394601582.0000000012830000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsCredentialProvider.dll.3.dr
                              Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetRunner.pdb source: ScreenConnect.ClientSetup (1).exe
                              Source: ScreenConnect.ClientSetup (1).exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
                              Source: ScreenConnect.ClientSetup (1).exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
                              Source: ScreenConnect.ClientSetup (1).exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
                              Source: ScreenConnect.ClientSetup (1).exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
                              Source: ScreenConnect.ClientSetup (1).exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

                              Data Obfuscation

                              barindex
                              .NET source code contains potential unpacker
                              Source: 0.2.ScreenConnect.ClientSetup (1).exe.32d0000.0.raw.unpack, Program.cs.Net Code: Main System.Reflection.Assembly.Load(byte[])
                              Source: 0.0.ScreenConnect.ClientSetup (1).exe.5578f8.1.raw.unpack, Program.cs.Net Code: Main System.Reflection.Assembly.Load(byte[])
                              Source: ScreenConnect.ClientSetup (1).exeStatic PE information: real checksum: 0x54fd91 should be: 0x563b83
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeCode function: 0_2_05C2B9F8 push ds; ret 0_2_05C2BBA2
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeCode function: 0_2_05C2BBDB push ds; ret 0_2_05C2BCD2
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeCode function: 0_2_05C25523 push eax; retf 0_2_05C25529
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeCode function: 0_2_05C2C793 pushad ; ret 0_2_05C2C799
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeCode function: 0_2_05C2B0BF push ss; ret 0_2_05C2B0C2
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeCode function: 0_2_05C2BCD3 push ds; ret 0_2_05C2BCDA
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeCode function: 0_2_05C2AFF8 push ss; ret 0_2_05C2AFFA
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeCode function: 0_2_05C2BBC3 push ds; ret 0_2_05C2BBCA
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeCode function: 0_2_05C2BBC0 push ds; ret 0_2_05C2BBC2
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeCode function: 0_2_05C2BBD8 push ds; ret 0_2_05C2BBDA
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeCode function: 0_2_05C2BBA3 push ds; ret 0_2_05C2BBAA
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeCode function: 0_2_05C4650D push A090CC6Dh; ret 0_2_05C46512
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeCode function: 0_2_05C41C81 push edi; ret 0_2_05C41C82
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeCode function: 0_2_05C41C99 push edi; ret 0_2_05C41C9A
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeCode function: 0_2_05C41C0F push esp; ret 0_2_05C41C12
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeCode function: 0_2_05C41C31 push edi; ret 0_2_05C41C32
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeCode function: 0_2_05C42F58 push eax; mov dword ptr [esp], edx0_2_05C42F6C
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeCode function: 0_2_05C40E30 push eax; ret 0_2_05C4114A
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeCode function: 0_2_05C461F1 pushfd ; ret 0_2_05C461F2
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeCode function: 0_2_05C41980 push edx; ret 0_2_05C41A0A
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeCode function: 0_2_05C41140 push eax; ret 0_2_05C41142
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeCode function: 0_2_05C42879 push 67C805C3h; ret 0_2_05C4287E
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeCode function: 0_2_05C41B01 push ebx; ret 0_2_05C41B02
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeCode function: 0_2_05C41B19 push ebx; ret 0_2_05C41B1A
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeCode function: 0_2_05C462FB pushfd ; ret 0_2_05C46302
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeCode function: 0_2_05C41A91 push edx; ret 0_2_05C41A92
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeCode function: 0_2_05C41A93 push eax; mov dword ptr [esp], ecx0_2_05C41AA1
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeCode function: 0_2_05C44AA8 push 0000007Ch; ret 0_2_05C44ABE
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeCode function: 0_2_05C41AB1 push ebx; ret 0_2_05C41AB2
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeCode function: 0_2_05C41AB3 push edx; ret 0_2_05C41ABA
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeCode function: 0_2_05C41A41 push edx; ret 0_2_05C41A42
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.Core.dllJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsCredentialProvider.dllJump to dropped file
                              Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSICF5E.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dllJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSID7CD.tmpJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsFileManager.exeJump to dropped file
                              Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSICF5E.tmp-\ScreenConnect.Core.dllJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsBackstageShell.exeJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.Client.dllJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsAuthenticationPackage.dllJump to dropped file
                              Source: C:\Windows\SysWOW64\msiexec.exeFile created: C:\Users\user\AppData\Local\Temp\MSICF5E.tmpJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeJump to dropped file
                              Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSICF5E.tmp-\ScreenConnect.InstallerActions.dllJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSID53B.tmpJump to dropped file
                              Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSICF5E.tmp-\Microsoft.Deployment.Compression.Cab.dllJump to dropped file
                              Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSICF5E.tmp-\Microsoft.Deployment.WindowsInstaller.dllJump to dropped file
                              Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSICF5E.tmp-\ScreenConnect.Windows.dllJump to dropped file
                              Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSICF5E.tmp-\Microsoft.Deployment.Compression.dllJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.dllJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.Windows.dllJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSID7CD.tmpJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSID53B.tmpJump to dropped file
                              Source: ScreenConnect.ClientService.dll.3.drBinary or memory string: bcdedit.exeg/copy {current} /d "Reboot and Reconnect Safe Mode"7{.{8}-.{4}-.{4}-.{4}-.{12}}
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ScreenConnect.ClientSetup (1).exe.logJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeRegistry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\ApplicationJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeRegistry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (ccf23f1afa8af061)Jump to behavior

                              Hooking and other Techniques for Hiding and Protection

                              barindex
                              Contains functionality to hide user accounts
                              Source: ScreenConnect.ClientSetup (1).exe, 00000000.00000002.2153260168.0000000005A50000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                              Source: ScreenConnect.ClientSetup (1).exe, 00000000.00000000.2128643109.0000000000026000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                              Source: rundll32.exe, 00000005.00000003.2151662935.0000000004F8F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                              Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.3383842926.00000000026E0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
                              Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.3402390424.000000001B762000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                              Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.3397910203.000000001B152000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
                              Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.3384013467.0000000002821000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
                              Source: ScreenConnect.ClientSetup (1).exeString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                              Source: ScreenConnect.Windows.dll.5.drString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                              Source: ScreenConnect.Windows.dll.3.drString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                              Source: ScreenConnect.ClientService.dll.3.drString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeMemory allocated: 16E0000 memory reserve | memory write watchJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeMemory allocated: 34C0000 memory reserve | memory write watchJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeMemory allocated: 1910000 memory reserve | memory write watchJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeMemory allocated: 6B10000 memory reserve | memory write watchJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeMemory allocated: 61F0000 memory reserve | memory write watchJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeMemory allocated: 7B10000 memory reserve | memory write watchJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeMemory allocated: 8B10000 memory reserve | memory write watchJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeMemory allocated: 8D90000 memory reserve | memory write watchJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeMemory allocated: 9D90000 memory reserve | memory write watchJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeMemory allocated: 1DF0000 memory reserve | memory write watchJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeMemory allocated: 2050000 memory reserve | memory write watchJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeMemory allocated: 1E70000 memory reserve | memory write watchJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeMemory allocated: EF0000 memory reserve | memory write watchJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeMemory allocated: 1A820000 memory reserve | memory write watchJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeThread delayed: delay time: 922337203685477Jump to behavior
                              Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.Core.dllJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsCredentialProvider.dllJump to dropped file
                              Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSICF5E.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dllJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Installer\MSID7CD.tmpJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsFileManager.exeJump to dropped file
                              Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSICF5E.tmp-\ScreenConnect.Core.dllJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsBackstageShell.exeJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.Client.dllJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsAuthenticationPackage.dllJump to dropped file
                              Source: C:\Windows\SysWOW64\msiexec.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSICF5E.tmpJump to dropped file
                              Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSICF5E.tmp-\ScreenConnect.InstallerActions.dllJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Installer\MSID53B.tmpJump to dropped file
                              Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSICF5E.tmp-\Microsoft.Deployment.Compression.Cab.dllJump to dropped file
                              Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSICF5E.tmp-\Microsoft.Deployment.WindowsInstaller.dllJump to dropped file
                              Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSICF5E.tmp-\ScreenConnect.Windows.dllJump to dropped file
                              Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSICF5E.tmp-\Microsoft.Deployment.Compression.dllJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.dllJump to dropped file
                              Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.Windows.dllJump to dropped file
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exe TID: 6188Thread sleep time: -922337203685477s >= -30000sJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exe TID: 5356Thread sleep count: 39 > 30Jump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exe TID: 4368Thread sleep time: -30000s >= -30000sJump to behavior
                              Source: C:\Windows\System32\svchost.exe TID: 3516Thread sleep time: -30000s >= -30000s
                              Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0
                              Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                              Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeThread delayed: delay time: 922337203685477Jump to behavior
                              Source: 6ed329.msi.3.drBinary or memory string: VMCi-
                              Source: svchost.exe, 0000000A.00000002.3382346922.00000161B942B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.3383180104.00000161BEA58000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                              Source: ScreenConnect.ClientService.exe, 00000008.00000002.3409815361.00000000053E0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                              Source: C:\Windows\System32\msiexec.exeProcess information queried: ProcessInformationJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeProcess token adjusted: DebugJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeProcess token adjusted: DebugJump to behavior
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeMemory allocated: page read and write | page guardJump to behavior

                              HIPS / PFW / Operating System Protection Evasion

                              barindex
                              .NET source code references suspicious native API functions
                              Source: 0.2.ScreenConnect.ClientSetup (1).exe.32d0000.0.raw.unpack, Program.csReference to suspicious API methods: FindResource(moduleHandle, e.Name, "FILES")
                              Source: 0.0.ScreenConnect.ClientSetup (1).exe.263d8.3.raw.unpack, NativeLibrary.csReference to suspicious API methods: LoadLibrary(type, assemblyTypeHint)
                              Source: 0.2.ScreenConnect.ClientSetup (1).exe.5a50000.3.raw.unpack, WindowsMemoryNativeLibrary.csReference to suspicious API methods: WindowsNative.VirtualAlloc(attemptImageBase, dwSize, WindowsNative.MEM.MEM_COMMIT | WindowsNative.MEM.MEM_RESERVE, WindowsNative.PAGE.PAGE_READWRITE)
                              Source: 0.2.ScreenConnect.ClientSetup (1).exe.5a50000.3.raw.unpack, WindowsMemoryNativeLibrary.csReference to suspicious API methods: WindowsNative.GetProcAddress(intPtr, ptr5)
                              Source: 0.2.ScreenConnect.ClientSetup (1).exe.5a50000.3.raw.unpack, WindowsMemoryNativeLibrary.csReference to suspicious API methods: WindowsNative.VirtualProtect(loadedImageBase + sectionHeaders[i].VirtualAddress, (IntPtr)num, flNewProtect, &pAGE)
                              Source: 0.2.ScreenConnect.ClientSetup (1).exe.5a50000.3.raw.unpack, WindowsExtensions.csReference to suspicious API methods: HandleMinder.CreateWithFunc(WindowsNative.OpenProcess(processAccess, bInheritHandle: false, processID), WindowsNative.CloseHandle)
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeProcess created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ScreenConnect\ccf23f1afa8af061\setup.msi"Jump to behavior
                              Source: unknownProcess created: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exe "c:\program files (x86)\screenconnect client (ccf23f1afa8af061)\screenconnect.clientservice.exe" "?e=access&y=guest&h=instance-f13iq7-relay.screenconnect.com&p=443&s=8c4565db-ac67-42c5-9630-9aa3f157ab83&k=bgiaaackaabsu0exaagaaaeaaqc1my9w4b1kmci8rrvvcn3qv2pf2incneac5%2f57%2frqys%2fxwv8jitthxen5si4wll36rpm9kv99bb78rmsviucckbje5kmpupwzsrqproxsxvln2bqj43r%2b0c1xzj6wxus%2bgcdb3y5osdtbax4izwcsx%2fwd5mibcxfxyv0gdsys7upqqnxsntw1v5ptrv4hh6ken7ig8xd119ofxklw0j4quxgapgwpi4dz5e20cimcrqfpc5dqnbzskd%2bnq0l48ao%2fzm5obrnv%2f8giwiobi%2f%2b9h0bqvztiy4rypoyseqrh3ovder1owmdv0fgctguaa5uynjokxrlqk4n1ztmqhr%2f%2bi&c=van%20buren%20telephone%20company&c=&c=&c=&c=&c=&c=&c="
                              Source: ScreenConnect.WindowsClient.exe, 00000009.00000000.2182692087.0000000000622000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.WindowsClient.exe.3.drBinary or memory string: Progman
                              Source: ScreenConnect.WindowsClient.exe, 00000009.00000000.2182692087.0000000000622000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.WindowsClient.exe.3.drBinary or memory string: Shell_TrayWnd-Shell_SecondaryTrayWnd%MsgrIMEWindowClass
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                              Source: C:\Windows\SysWOW64\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
                              Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Users\user\AppData\Local\Temp\MSICF5E.tmp-\Microsoft.Deployment.WindowsInstaller.dll VolumeInformationJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Users\user\AppData\Local\Temp\MSICF5E.tmp-\ScreenConnect.InstallerActions.dll VolumeInformationJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Users\user\AppData\Local\Temp\MSICF5E.tmp-\ScreenConnect.Core.dll VolumeInformationJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Users\user\AppData\Local\Temp\MSICF5E.tmp-\ScreenConnect.Windows.dll VolumeInformationJump to behavior
                              Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.dll VolumeInformationJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.dll VolumeInformationJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.Core.dll VolumeInformationJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.Windows.dll VolumeInformationJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.Client.dll VolumeInformationJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exe VolumeInformationJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.Client.dll VolumeInformationJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.Core.dll VolumeInformationJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.Windows.dll VolumeInformationJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformationJump to behavior
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.dll VolumeInformationJump to behavior
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
                              Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exeCode function: 8_2_01E34D2E RtlGetVersion,8_2_01E34D2E
                              Source: C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                              Lowering of HIPS / PFW / Operating System Security Settings

                              barindex
                              Modifies security policies related information
                              Source: C:\Windows\System32\msiexec.exeRegistry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa Authentication PackagesJump to behavior
                              Source: Yara matchFile source: ScreenConnect.ClientSetup (1).exe, type: SAMPLE
                              Source: Yara matchFile source: 0.2.ScreenConnect.ClientSetup (1).exe.5cc0000.7.raw.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 9.2.ScreenConnect.WindowsClient.exe.289fa28.2.raw.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 9.0.ScreenConnect.WindowsClient.exe.620000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 0.0.ScreenConnect.ClientSetup (1).exe.d5db8.2.raw.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 0.2.ScreenConnect.ClientSetup (1).exe.5cc0000.7.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 0.0.ScreenConnect.ClientSetup (1).exe.ac3d8.5.raw.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 0.0.ScreenConnect.ClientSetup (1).exe.10000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 0.0.ScreenConnect.ClientSetup (1).exe.263d8.3.raw.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 00000000.00000002.2155563654.0000000005CC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000009.00000000.2182692087.0000000000622000.00000002.00000001.01000000.00000011.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000009.00000002.3384013467.0000000002821000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000000.00000000.2128643109.0000000000026000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                              Source: Yara matchFile source: Process Memory Space: ScreenConnect.ClientSetup (1).exe PID: 5208, type: MEMORYSTR
                              Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 6932, type: MEMORYSTR
                              Source: Yara matchFile source: Process Memory Space: ScreenConnect.ClientService.exe PID: 1372, type: MEMORYSTR
                              Source: Yara matchFile source: Process Memory Space: ScreenConnect.WindowsClient.exe PID: 5156, type: MEMORYSTR
                              Source: Yara matchFile source: C:\Config.Msi\6ed328.rbs, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Windows\Installer\MSID52B.tmp, type: DROPPED

                              Mitre Att&ck Matrix

                              ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                              Gather Victim Identity InformationAcquire Infrastructure1
                              Valid Accounts                              		1
                              Native API                              		1
                              DLL Side-Loading                              		1
                              DLL Side-Loading                              		11
                              Disable or Modify Tools                              		OS Credential Dumping11
                              Peripheral Device Discovery                              		Remote Services11
                              Archive Collected Data                              		22
                              Encrypted Channel                              		Exfiltration Over Other Network MediumAbuse Accessibility Features
                              CredentialsDomains1
                              Replication Through Removable Media                              		12
                              Command and Scripting Interpreter                              		1
                              DLL Search Order Hijacking                              		1
                              DLL Search Order Hijacking                              		1
                              Deobfuscate/Decode Files or Information                              		LSASS Memory1
                              File and Directory Discovery                              		Remote Desktop ProtocolData from Removable Media1
                              Non-Application Layer Protocol                              		Exfiltration Over BluetoothNetwork Denial of Service
                              Email AddressesDNS ServerDomain AccountsAt1
                              Valid Accounts                              		1
                              Valid Accounts                              		1
                              Obfuscated Files or Information                              		Security Account Manager24
                              System Information Discovery                              		SMB/Windows Admin SharesData from Network Shared Drive2
                              Application Layer Protocol                              		Automated ExfiltrationData Encrypted for Impact
                              Employee NamesVirtual Private ServerLocal AccountsCron2
                              Windows Service                              		1
                              Access Token Manipulation                              		1
                              Software Packing                              		NTDS11
                              Security Software Discovery                              		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
                              Gather Victim Network InformationServerCloud AccountsLaunchd1
                              Bootkit                              		2
                              Windows Service                              		1
                              DLL Side-Loading                              		LSA Secrets2
                              Process Discovery                              		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                              Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts12
                              Process Injection                              		1
                              DLL Search Order Hijacking                              		Cached Domain Credentials41
                              Virtualization/Sandbox Evasion                              		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                              DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
                              File Deletion                              		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                              Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job22
                              Masquerading                              		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                              Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
                              Valid Accounts                              		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                              IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron1
                              Access Token Manipulation                              		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
                              Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd41
                              Virtualization/Sandbox Evasion                              		Input CaptureSystem Network Connections DiscoverySoftware Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption
                              Gather Victim Org InformationDNS ServerCompromise Software Supply ChainWindows Command ShellScheduled TaskScheduled Task12
                              Process Injection                              		KeyloggingProcess DiscoveryTaint Shared ContentScreen CaptureDNSExfiltration Over Physical MediumResource Hijacking
                              Determine Physical LocationsVirtual Private ServerCompromise Hardware Supply ChainUnix ShellSystemd TimersSystemd Timers1
                              Hidden Users                              		GUI Input CapturePermission Groups DiscoveryReplication Through Removable MediaEmail CollectionProxyExfiltration over USBNetwork Denial of Service
                              Business RelationshipsServerTrusted RelationshipVisual BasicContainer Orchestration JobContainer Orchestration Job1
                              Bootkit                              		Web Portal CaptureLocal GroupsComponent Object Model and Distributed COMLocal Email CollectionInternal ProxyCommonly Used PortDirect Network Flood
                              Identify Business TempoBotnetHardware AdditionsPythonHypervisorProcess Injection1
                              Rundll32                              		Credential API HookingDomain GroupsExploitation of Remote ServicesRemote Email CollectionExternal ProxyTransfer Data to Cloud AccountReflection Amplification

                              Behavior Graph

                              Hide Legend

                              Legend:

                              • Process
                              • Signature
                              • Created File
                              • DNS/IP Info
                              • Is Dropped
                              • Is Windows Process
                              • Number of created Registry Values
                              • Number of created Files
                              • Visual Basic
                              • Delphi
                              • Java
                              • .Net C# or VB.NET
                              • C, C++ or other language
                              • Is malicious
                              • Internet
                              behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1524529 Sample: ScreenConnect.ClientSetup (1).exe Startdate: 02/10/2024 Architecture: WINDOWS Score: 57 55 instance-f13iq7-relay.screenconnect.com 2->55 57 server-nix282c8ff2-relay.screenconnect.com 2->57 65 .NET source code contains potential unpacker 2->65 67 .NET source code references suspicious native API functions 2->67 69 Contains functionality to hide user accounts 2->69 71 2 other signatures 2->71 8 msiexec.exe 93 49 2->8         started        12 ScreenConnect.ClientService.exe 17 21 2->12         started        15 ScreenConnect.ClientSetup (1).exe 5 2->15         started        17 svchost.exe 2->17         started        signatures3 process4 dnsIp5 35 C:\...\ScreenConnect.ClientService.exe, PE32 8->35 dropped 37 C:\Windows\Installer\MSID7CD.tmp, PE32 8->37 dropped 39 C:\Windows\Installer\MSID53B.tmp, PE32 8->39 dropped 43 9 other files (none is malicious) 8->43 dropped 73 Enables network access during safeboot for specific services 8->73 75 Modifies security policies related information 8->75 19 msiexec.exe 8->19         started        21 msiexec.exe 1 8->21         started        23 msiexec.exe 8->23         started        59 server-nix282c8ff2-relay.screenconnect.com 147.28.146.148, 443, 49712, 49715 RGNET-SEARGnetSeattleWestinEE United States 12->59 77 Reads the Security eventlog 12->77 79 Reads the System eventlog 12->79 25 ScreenConnect.WindowsClient.exe 2 12->25         started        41 C:\...\ScreenConnect.ClientSetup (1).exe.log, ASCII 15->41 dropped 81 Contains functionality to hide user accounts 15->81 28 msiexec.exe 6 15->28         started        61 127.0.0.1 unknown unknown 17->61 file6 signatures7 process8 file9 31 rundll32.exe 11 19->31         started        83 Contains functionality to hide user accounts 25->83 45 C:\Users\user\AppData\Local\...\MSICF5E.tmp, PE32 28->45 dropped signatures10 process11 file12 47 C:\Users\user\...\ScreenConnect.Windows.dll, PE32 31->47 dropped 49 C:\...\ScreenConnect.InstallerActions.dll, PE32 31->49 dropped 51 C:\Users\user\...\ScreenConnect.Core.dll, PE32 31->51 dropped 53 4 other files (none is malicious) 31->53 dropped 63 Contains functionality to hide user accounts 31->63 signatures13

                              Screenshots

                              Thumbnails

                              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                              windows-stand

                              Antivirus, Machine Learning and Genetic Malware Detection

                              Initial Sample

                              ⊘No Antivirus matches

                              Dropped Files

                              SourceDetectionScannerLabelLink
                              C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.Client.dll0%ReversingLabs
                              C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.dll0%ReversingLabs
                              C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exe0%ReversingLabs
                              C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.Core.dll0%ReversingLabs
                              C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.Windows.dll0%ReversingLabs
                              C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsAuthenticationPackage.dll0%ReversingLabs
                              C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsBackstageShell.exe0%ReversingLabs
                              C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exe0%ReversingLabs
                              C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsCredentialProvider.dll0%ReversingLabs
                              C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsFileManager.exe0%ReversingLabs
                              C:\Users\user\AppData\Local\Temp\MSICF5E.tmp0%ReversingLabs
                              C:\Users\user\AppData\Local\Temp\MSICF5E.tmp-\Microsoft.Deployment.Compression.Cab.dll0%ReversingLabs
                              C:\Users\user\AppData\Local\Temp\MSICF5E.tmp-\Microsoft.Deployment.Compression.dll0%ReversingLabs
                              C:\Users\user\AppData\Local\Temp\MSICF5E.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll0%ReversingLabs
                              C:\Users\user\AppData\Local\Temp\MSICF5E.tmp-\Microsoft.Deployment.WindowsInstaller.dll0%ReversingLabs
                              C:\Users\user\AppData\Local\Temp\MSICF5E.tmp-\ScreenConnect.Core.dll0%ReversingLabs
                              C:\Users\user\AppData\Local\Temp\MSICF5E.tmp-\ScreenConnect.InstallerActions.dll0%ReversingLabs
                              C:\Users\user\AppData\Local\Temp\MSICF5E.tmp-\ScreenConnect.Windows.dll0%ReversingLabs
                              C:\Windows\Installer\MSID53B.tmp0%ReversingLabs
                              C:\Windows\Installer\MSID7CD.tmp0%ReversingLabs

                              Unpacked PE Files

                              ⊘No Antivirus matches

                              Domains

                              ⊘No Antivirus matches

                              URLs

                              SourceDetectionScannerLabelLink
                              http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0%URL Reputationsafe

                              Domains and IPs

                              Contacted Domains

                              NameIPActiveMaliciousAntivirus DetectionReputation
                              server-nix282c8ff2-relay.screenconnect.com
                              		147.28.146.148
                              		truefalse
                                		unknown
                                instance-f13iq7-relay.screenconnect.com
                                		unknown
                                		unknowntrue
                                  		unknown

                                  URLs from Memory and Binaries

                                  NameSourceMaliciousAntivirus DetectionReputation
                                  https://g.live.com/odclientsettings/ProdV21C:svchost.exe, 0000000A.00000003.2204288342.00000161BE950000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.drfalse
                                    		unknown
                                    http://crl.ver)svchost.exe, 0000000A.00000002.3383232377.00000161BEA85000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		unknown
                                      http://instance-f13iq7-relay.screenconnect.com:443/dScreenConnect.ClientService.exe, 00000008.00000002.3385079129.00000000022CA000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.3385079129.0000000002204000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.3385079129.0000000002275000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.3385079129.00000000024E9000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.3385079129.000000000240B000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.3385079129.00000000020B2000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.3385079129.000000000234F000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		unknown
                                        http://wixtoolset.org/releases/rundll32.exe, 00000005.00000003.2151662935.0000000004F14000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2151662935.0000000004F83000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2151835205.0000000004E03000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.Cab.dll.5.dr, Microsoft.Deployment.Compression.dll.5.dr, Microsoft.Deployment.WindowsInstaller.dll.5.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.5.drfalse
                                          		unknown
                                          https://g.live.com/odclientsettings/Prod1C:qmgr.db.10.drfalse
                                            		unknown
                                            http://wixtoolset.org/news/rundll32.exe, 00000005.00000003.2151662935.0000000004F14000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2151662935.0000000004F83000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2151835205.0000000004E03000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.Cab.dll.5.dr, Microsoft.Deployment.Compression.dll.5.dr, Microsoft.Deployment.WindowsInstaller.dll.5.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.5.drfalse
                                              		unknown
                                              http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameScreenConnect.ClientSetup (1).exe, 00000000.00000002.2149354887.00000000034C1000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000008.00000002.3385079129.00000000020B2000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              http://instance-f13iq7-relay.screenconnect.com:443/OScreenConnect.ClientService.exe, 00000008.00000002.3381913415.0000000001411000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		unknown
                                                http://wixtoolset.org/Whttp://wixtoolset.org/telemetry/vrundll32.exe, 00000005.00000003.2151662935.0000000004F14000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2151662935.0000000004F83000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2151835205.0000000004E03000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.Cab.dll.5.dr, Microsoft.Deployment.Compression.dll.5.dr, Microsoft.Deployment.WindowsInstaller.dll.5.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.5.drfalse
                                                  		unknown
                                                  https://feedback.screenconnect.com/Feedback.axdScreenConnect.Core.dll.3.drfalse
                                                    		unknown
                                                    https://docs.rs/getrandom#nodejs-es-module-supportScreenConnect.WindowsCredentialProvider.dll.3.drfalse
                                                      		unknown

                                                      World Map of Contacted IPs

                                                      • No. of IPs < 25%
                                                      • 25% < No. of IPs < 50%
                                                      • 50% < No. of IPs < 75%
                                                      • 75% < No. of IPs

                                                      Public IPs

                                                      IPDomainCountryFlagASNASN NameMalicious
                                                      147.28.146.148
                                                      		server-nix282c8ff2-relay.screenconnect.comUnited States
                                                      		3130RGNET-SEARGnetSeattleWestinEEfalse

                                                      Private

                                                      IP
                                                      127.0.0.1

                                                      General Information

                                                      Joe Sandbox version:41.0.0 Charoite
                                                      Analysis ID:1524529
                                                      Start date and time:2024-10-02 22:59:55 +02:00
                                                      Joe Sandbox product:CloudBasic
                                                      Overall analysis duration:0h 7m 56s
                                                      Hypervisor based Inspection enabled:false
                                                      Report type:full
                                                      Cookbook file name:default.jbs
                                                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                      Number of analysed new started processes analysed:15
                                                      Number of new started drivers analysed:0
                                                      Number of existing processes analysed:0
                                                      Number of existing drivers analysed:0
                                                      Number of injected processes analysed:0
                                                      Technologies:
                                                      • HCA enabled
                                                      • EGA enabled
                                                      • AMSI enabled
                                                      Analysis Mode:default
                                                      Analysis stop reason:Timeout
                                                      Sample name:ScreenConnect.ClientSetup (1).exe
                                                      Detection:MAL
                                                      Classification:mal57.evad.winEXE@16/65@3/2
                                                      EGA Information:
                                                      • Successful, ratio: 50%
                                                      HCA Information:
                                                      • Successful, ratio: 80%
                                                      • Number of executed functions: 327
                                                      • Number of non-executed functions: 7
                                                      Cookbook Comments:
                                                      • Found application associated with file extension: .exe

                                                      Warnings

                                                      • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
                                                      • Excluded IPs from analysis (whitelisted): 184.28.90.27
                                                      • Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
                                                      • Execution Graph export aborted for target ScreenConnect.ClientSetup (1).exe, PID 5208 because it is empty
                                                      • Execution Graph export aborted for target rundll32.exe, PID 6932 because it is empty
                                                      • Report size exceeded maximum capacity and may have missing behavior information.
                                                      • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                      • Report size getting too big, too many NtEnumerateKey calls found.
                                                      • Report size getting too big, too many NtOpenKeyEx calls found.
                                                      • Report size getting too big, too many NtQueryValueKey calls found.
                                                      • Report size getting too big, too many NtSetInformationFile calls found.
                                                      • VT rate limit hit for: ScreenConnect.ClientSetup (1).exe

                                                      Simulations

                                                      Behavior and APIs

                                                      TimeTypeDescription
                                                      17:00:53API Interceptor2x Sleep call for process: svchost.exe modified
                                                      17:00:57API Interceptor1x Sleep call for process: ScreenConnect.ClientService.exe modified

                                                      Joe Sandbox View / Context

                                                      IPs

                                                      ⊘No context

                                                      Domains

                                                      ⊘No context

                                                      ASNs

                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                      RGNET-SEARGnetSeattleWestinEEXML_00000S1D4S555555S4D111111S.exeGet hashmaliciousScreenConnect ToolBrowse
                                                      • 147.28.128.212
                                                      XML_00000S1D4S555555S4D111111S.exeGet hashmaliciousScreenConnect ToolBrowse
                                                      • 147.28.128.212
                                                      http://playsportzone.comGet hashmaliciousUnknownBrowse
                                                      • 147.28.146.89
                                                      ScreenConnect.Client.exeGet hashmaliciousScreenConnect ToolBrowse
                                                      • 147.28.147.228
                                                      ScreenConnect.Client.exeGet hashmaliciousScreenConnect ToolBrowse
                                                      • 147.28.147.228
                                                      https://i.imgur.com/EoTj4iI.pngGet hashmaliciousUnknownBrowse
                                                      • 147.28.129.37
                                                      https://i.imgur.com/VlAllek.pngGet hashmaliciousUnknownBrowse
                                                      • 147.28.146.89
                                                      ScreenConnect.Client.exeGet hashmaliciousScreenConnect ToolBrowse
                                                      • 147.28.128.254
                                                      ScreenConnect.Client.exeGet hashmaliciousScreenConnect ToolBrowse
                                                      • 147.28.128.254
                                                      Remittance. #U0440df.htmlGet hashmaliciousHTMLPhisherBrowse
                                                      • 147.28.146.89

                                                      JA3 Fingerprints

                                                      ⊘No context

                                                      Dropped Files

                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                      C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.dllScan_doc_09_16_24_1120.exeGet hashmaliciousScreenConnect ToolBrowse
                                                        E_BILL9926378035.exeGet hashmaliciousScreenConnect ToolBrowse
                                                          Scan_doc_09_16_24_1203.exeGet hashmaliciousScreenConnect ToolBrowse
                                                            E_BILL0041272508.exeGet hashmaliciousScreenConnect ToolBrowse
                                                              Scan_doc_09_16_24_1120.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                E_BILL9926378035.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                  Scan_doc_09_16_24_1203.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                    E_BILL0041272508.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                      Scan_PDF_5255303072.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                        invoice-benefits-agency9-24-2024.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                          C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.Client.dllScan_doc_09_16_24_1120.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                            E_BILL9926378035.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                              Scan_doc_09_16_24_1203.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                E_BILL0041272508.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                  Scan_doc_09_16_24_1120.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                    E_BILL9926378035.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                      Scan_doc_09_16_24_1203.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                        E_BILL0041272508.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                          Scan_PDF_5255303072.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                            invoice-benefits-agency9-24-2024.exeGet hashmaliciousScreenConnect ToolBrowse

                                                                                              Created / dropped Files

                                                                                              C:\Config.Msi\6ed328.rbs

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:data
                                                                                              Category:modified
                                                                                              Size (bytes):219464
                                                                                              Entropy (8bit):6.5817345491799735
                                                                                              Encrypted:false
                                                                                              SSDEEP:6144:dw7imIkX+oTgXdvfgli5tN1P3hbpvMLuH2aCGw1ST1wQLdqvHfZddnzce:dw7imIkX+oTgXdvfgli5tNZ3hbpvMLu6
                                                                                              MD5:66B77FFD416C8126262BBA869D86CF61
                                                                                              SHA1:42742DAA4D568C623EEB6F6EA755C8E51F0285E3
                                                                                              SHA-256:BF43B4E1656DBE8742B5B281B77171F77B5116E46CA38DAFA1F40008F239CBC8
                                                                                              SHA-512:DC12C86A0643E91670B95F5D3C09AF6080DA7972972C312A67EDB3DB917CD529000777E1B72446D4633D318A571E3709969E01444BED15D736202AD735F173D4
                                                                                              Malicious:false
                                                                                              Yara Hits:
                                                                                              • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Config.Msi\6ed328.rbs, Author: Joe Security
                                                                                              Reputation:low
                                                                                              Preview:...@IXOS.@.....@..BY.@.....@.....@.....@.....@.....@......&.{7C192981-00FA-4F6A-CC5D-8D3B0AD966AA}'.ScreenConnect Client (ccf23f1afa8af061)..setup.msi.@.....@.....@.....@......DefaultIcon..&.{7C192981-00FA-4F6A-CC5D-8D3B0AD966AA}.....@.....@.....@.....@.......@.....@.....@.......@....'.ScreenConnect Client (ccf23f1afa8af061)......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{7DC48333-CC95-5DFB-5E2F-C424ED87B3C4}&.{7C192981-00FA-4F6A-CC5D-8D3B0AD966AA}.@......&.{709D0D7A-CE6E-4B21-DBC3-9ED12FB054CB}&.{7C192981-00FA-4F6A-CC5D-8D3B0AD966AA}.@......&.{336DF891-5830-F1F1-A97E-4C484346DBC5}&.{7C192981-00FA-4F6A-CC5D-8D3B0AD966AA}.@......&.{7E4B3E97-C8A3-4BA3-379D-431694E8BEB7}&.{7C192981-00FA-4F6A-CC5D-8D3B0AD966AA}.@......&.{ACE7A76A-6C5D-F2D1-4AE3-2373406F2B99}&.{7C192981-00FA-4F6A-CC5D-8D3B0AD966AA}.@......&.{0693EEDE-7888-B977-48B9-DDD432E11B9D}&.{7C192981-00FA-4F6A-CC5D-8D3B0AD966AA}.@....

                                                                                              C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\Client.en-US.resources

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:data
                                                                                              Category:dropped
                                                                                              Size (bytes):50133
                                                                                              Entropy (8bit):4.759054454534641
                                                                                              Encrypted:false
                                                                                              SSDEEP:1536:p1+F+UTQd/3EUDv8vw+Dsj2jr0FJK97w/Leh/KR1exJKekmrg9:p1+F+UTQWUDv8vw+Dsj2jr0FJK97w/LR
                                                                                              MD5:D524E8E6FD04B097F0401B2B668DB303
                                                                                              SHA1:9486F89CE4968E03F6DCD082AA2E4C05AEF46FCC
                                                                                              SHA-256:07D04E6D5376FFC8D81AFE8132E0AA6529CCCC5EE789BEA53D56C1A2DA062BE4
                                                                                              SHA-512:E5BC6B876AFFEB252B198FEB8D213359ED3247E32C1F4BFC2C5419085CF74FE7571A51CAD4EAAAB8A44F1421F7CA87AF97C9B054BDB83F5A28FA9A880D4EFDE5
                                                                                              Malicious:false
                                                                                              Preview:...........lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.q...'..6....wp.......y....C|.)>..Ldt..... $...X..........1$.../...2.%%3./>>...L.y.0.C._.........1Y..Qj.o....<....=...R..;...C....&.......1p2.r.x.u?Y..R...c......X.....I.5.2q..R...>.E.pw .@ ).w.l.....S...X..'.C.I......-.Y........4.J..P<.E..=c!.@To..#.._.2.....K.!..h...z......t......^..4...D...f..Q...:..%.z.<......^.....;<...r..yC.....Q........4_.Sns..z.......=..]t...X..<....8.e`}..n....S.H[..S@?.~....,...j.2..*v.......B....A...a......D..c..w..K,..t...S.....*v....7.6|..&.....r....#....G......Y...i..'.............'.......Z.....#2e..........|....)..%....A.....4{..u;N......&q...}.tD..x.....4...J...L......5.Q..M....K..3U..M..............5...........t.>.......lYu....3TY.?...r...'.......3.m........=.H...#.o.........n.....,4.~...<h..u...i.H...V......V/...P.$%..z...

                                                                                              C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\Client.resources

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:data
                                                                                              Category:dropped
                                                                                              Size (bytes):26722
                                                                                              Entropy (8bit):7.7401940386372345
                                                                                              Encrypted:false
                                                                                              SSDEEP:384:rAClIRkKxFCQPZhNAmutHcRIfvVf6yMt+FRVoSVCdcDk6jO0n/uTYUq5ZplYKlBy:MV3PZrXgTf6vEVm6zjpGYUElerG49
                                                                                              MD5:5CD580B22DA0C33EC6730B10A6C74932
                                                                                              SHA1:0B6BDED7936178D80841B289769C6FF0C8EEAD2D
                                                                                              SHA-256:DE185EE5D433E6CFBB2E5FCC903DBD60CC833A3CA5299F2862B253A41E7AA08C
                                                                                              SHA-512:C2494533B26128FBF8149F7D20257D78D258ABFFB30E4E595CB9C6A742F00F1BF31B1EE202D4184661B98793B9909038CF03C04B563CE4ECA1E2EE2DEC3BF787
                                                                                              Malicious:false
                                                                                              Preview:...........lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP)...s^.J.....E.....(....jF.C...1P)...H..../..72J..I.J.a.K8c._.ks`.k.`.kK..m.M6p............b...P...........'...!...............K...............w.......P.......1......."A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.1.6.....$A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.2.5.6....."A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.3.2....."A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.4.8.....,A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.B.l.a.n.k.1.6.;...(A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.M.a.c.2.2.....0A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.O.p.a.q.u.e.1.9.2.8...,A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.T.i.t.l.e.1.6.....6B.l.a.n.k.M.o.n.i.t.o.r.B.a.c.k.g.r.o.u.n.d.C.o.l.o.r.4...6B.l.a.n.k.M.o.n.i.t.o.r.B.a.c.k.g.r.o.u.n.d.I.m.a.g.e.:...DB.l.a.n.k.M.o.n.i.t.o.r.B.a.c.k.g.r.o.u.n.d.I.m.a.g.e.V.i.s.i.b.l.e.xb..*B.l.a.n.k.M.o.n.i.t.o.r.T.e.x.t.C.o.l.o.r..b..*D.a.r.k.T.h.e.m.e.B.a.r.B.a.s.e.C.o.l.o.r..b..<D.a.r.k.T.h.

                                                                                              C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.Client.dll

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                              Category:dropped
                                                                                              Size (bytes):197120
                                                                                              Entropy (8bit):6.58476728626163
                                                                                              Encrypted:false
                                                                                              SSDEEP:3072:CxGtNaldxI5KY9h12QMusqVFJRJcyzvJquFzDvJXYrR:BtNalc5fr12QbPJYaquFGr
                                                                                              MD5:AE0E6EBA123683A59CAE340C894260E9
                                                                                              SHA1:35A6F5EB87179EB7252131A881A8D5D4D9906013
                                                                                              SHA-256:D37F58AAE6085C89EDD3420146EB86D5A108D27586CB4F24F9B580208C9B85F1
                                                                                              SHA-512:1B6D4AD78C2643A861E46159D5463BA3EC5A23A2A3DE1575E22FDCCCD906EE4E9112D3478811AB391A130FA595306680B8608B245C1EECB11C5BCE098F601D6B
                                                                                              Malicious:false
                                                                                              Antivirus:
                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                              Joe Sandbox View:
                                                                                              • Filename: Scan_doc_09_16_24_1120.exe, Detection: malicious, Browse
                                                                                              • Filename: E_BILL9926378035.exe, Detection: malicious, Browse
                                                                                              • Filename: Scan_doc_09_16_24_1203.exe, Detection: malicious, Browse
                                                                                              • Filename: E_BILL0041272508.exe, Detection: malicious, Browse
                                                                                              • Filename: Scan_doc_09_16_24_1120.exe, Detection: malicious, Browse
                                                                                              • Filename: E_BILL9926378035.exe, Detection: malicious, Browse
                                                                                              • Filename: Scan_doc_09_16_24_1203.exe, Detection: malicious, Browse
                                                                                              • Filename: E_BILL0041272508.exe, Detection: malicious, Browse
                                                                                              • Filename: Scan_PDF_5255303072.exe, Detection: malicious, Browse
                                                                                              • Filename: invoice-benefits-agency9-24-2024.exe, Detection: malicious, Browse
                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Z<..........." ..0.................. ... ....... .......................`............@.................................-...O.... .......................@..........8............................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................a.......H...........(............^................................................(....*..(....*^.(...........%...}....*:.(......}....*:.(......}....*:.(......}....*..{....*:.(......}....*.0..A........(....s....%.~(...%-.&~'.....y...s....%.(...(...+(...+o"...o....*....0..s.......~#.....2. ....+...j..... ......... ...............%.r...p.%.r...p............%.&...($....5..............s%....=...*..0...........~*...%-.&~).....|...s&...%.*...(...+..~+...%-.&~).....}...s(...%.+...(...+.r9..

                                                                                              C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.dll

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                              Category:dropped
                                                                                              Size (bytes):68096
                                                                                              Entropy (8bit):6.068776675019683
                                                                                              Encrypted:false
                                                                                              SSDEEP:1536:tA0ZscQ5V6TsQqoSDKh6+39QFVIl1KJhb8gp:q0Zy3wUOQFVQKJp
                                                                                              MD5:0402CF8AE8D04FCC3F695A7BB9548AA0
                                                                                              SHA1:044227FA43B7654032524D6F530F5E9B608E5BE4
                                                                                              SHA-256:C76F1F28C5289758B6BD01769C5EBFB519EE37D0FA8031A13BB37DE83D849E5E
                                                                                              SHA-512:BE4CBC906EC3D189BEBD948D3D44FCF7617FFAE4CC3C6DC49BF4C0BD809A55CE5F8CD4580E409E5BCE7586262FBAF642085FA59FE55B60966DB48D81BA8C0D78
                                                                                              Malicious:false
                                                                                              Antivirus:
                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                              Joe Sandbox View:
                                                                                              • Filename: Scan_doc_09_16_24_1120.exe, Detection: malicious, Browse
                                                                                              • Filename: E_BILL9926378035.exe, Detection: malicious, Browse
                                                                                              • Filename: Scan_doc_09_16_24_1203.exe, Detection: malicious, Browse
                                                                                              • Filename: E_BILL0041272508.exe, Detection: malicious, Browse
                                                                                              • Filename: Scan_doc_09_16_24_1120.exe, Detection: malicious, Browse
                                                                                              • Filename: E_BILL9926378035.exe, Detection: malicious, Browse
                                                                                              • Filename: Scan_doc_09_16_24_1203.exe, Detection: malicious, Browse
                                                                                              • Filename: E_BILL0041272508.exe, Detection: malicious, Browse
                                                                                              • Filename: Scan_PDF_5255303072.exe, Detection: malicious, Browse
                                                                                              • Filename: invoice-benefits-agency9-24-2024.exe, Detection: malicious, Browse
                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0.T..........." ..0.............. ... ...@....... ..............................d.....@.................................e ..O....@.......................`..........8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................. ......H........n..@...................<.........................................(....*^.(...........%...}....*:.(......}....*:.(......}....*:.(......}....*.~,...%-.&~+.....i...s....%.,...(...+*vs....%.}P.........s....(....*....0...........s....}.....s....}...........}.......(&.....}.....(....&.()..........s....o.....()...~-...%-.&~+.....j...s....%.-...o ....s!...}.....s"...}.....s#...}...... .... 0u.........s....s=...}....... ..6........s....s=...}.....('...($............o%........

                                                                                              C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exe

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                              Category:dropped
                                                                                              Size (bytes):95520
                                                                                              Entropy (8bit):6.505346220942731
                                                                                              Encrypted:false
                                                                                              SSDEEP:1536:rg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgoT0HMM7CxM7:khbNDxZGXfdHrX7rAc6myJkgoT0HXN7
                                                                                              MD5:361BCC2CB78C75DD6F583AF81834E447
                                                                                              SHA1:1E2255EC312C519220A4700A079F02799CCD21D6
                                                                                              SHA-256:512F9D035E6E88E231F082CC7F0FF661AFA9ACC221CF38F7BA3721FD996A05B7
                                                                                              SHA-512:94BA891140E7DDB2EFA8183539490AC1B4E51E3D5BD0A4001692DD328040451E6F500A7FC3DA6C007D9A48DB3E6337B252CE8439E912D4FE7ADC762206D75F44
                                                                                              Malicious:true
                                                                                              Antivirus:
                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(..qF.qF.qF....qF.....qF....qF.<.B.qF.<.E.qF.<.C.qF....qF.#..qF.qG..qF.2.O.qF.2...qF.2.D.qF.Rich.qF.........................PE..L.....wc...............!.............!............@.......................................@.................................p...x....`..X............L.. )...p......`!..p............................ ..@............................................text...:........................... ..`.rdata...f.......h..................@..@.data........@.......,..............@....rsrc...X....`.......6..............@..@.reloc.......p.......<..............@..B........................................................................................................................................................................................................................................................................................

                                                                                              C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.Core.dll

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                              Category:dropped
                                                                                              Size (bytes):548864
                                                                                              Entropy (8bit):6.031251664661689
                                                                                              Encrypted:false
                                                                                              SSDEEP:6144:7+kYq9xDsxaUGEcANzZ1dkmn27qcO5noYKvKzDrzL9e7eOJsXziIYjVtkb+vbHq+:7SHtpnoVMlUbHbBaYLD
                                                                                              MD5:16C4F1E36895A0FA2B4DA3852085547A
                                                                                              SHA1:AB068A2F4FFD0509213455C79D311F169CD7CAB8
                                                                                              SHA-256:4D4BF19AD99827F63DD74649D8F7244FC8E29330F4D80138C6B64660C8190A53
                                                                                              SHA-512:AB4E67BE339BECA30CAB042C9EBEA599F106E1E0E2EE5A10641BEEF431A960A2E722A459534BDC7C82C54F523B21B4994C2E92AA421650EE4D7E0F6DB28B47BA
                                                                                              Malicious:false
                                                                                              Antivirus:
                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...z............." ..0..X...........r... ........... ...............................D....@..................................r..O....................................q..8............................................ ............... ..H............text....V... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................r......H........B......................xq........................................{:...*..{;...*V.(<.....}:.....};...*...0..A........u~.......4.,/(=....{:....{:...o>...,.(?....{;....{;...o@...*.*.*. ... )UU.Z(=....{:...oA...X )UU.Z(?....{;...oB...X*...0..b........r...p......%..{:......%q.........-.&.+.......oC....%..{;......%q.........-.&.+.......oC....(D...*..{E...*..{F...*V.(<.....}E.....}F...*.0..A........u........4.,/(=....{E....{E...o>...,.(?....{F....{F...o@...*.*.*. F.b# )UU.

                                                                                              C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.Windows.dll

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                              Category:dropped
                                                                                              Size (bytes):1721856
                                                                                              Entropy (8bit):6.639136400085158
                                                                                              Encrypted:false
                                                                                              SSDEEP:24576:gx5x94kEFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:gx5xKkEJkGYYpT0+TFiH7efP
                                                                                              MD5:9F823778701969823C5A01EF3ECE57B7
                                                                                              SHA1:DA733F482825EC2D91F9F1186A3F934A2EA21FA1
                                                                                              SHA-256:ABCA7CF12937DA14C9323C880EC490CC0E063D7A3EEF2EAC878CD25C84CF1660
                                                                                              SHA-512:FFC40B16F5EA2124629D797DC3A431BEB929373BFA773C6CDDC21D0DC4105D7360A485EA502CE8EA3B12EE8DCA8275A0EC386EA179093AF3AA8B31B4DD3AE1CA
                                                                                              Malicious:false
                                                                                              Antivirus:
                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l............" ..0..>...........]... ...`....... ..............................[.....@................................./]..O....`...............................\..8............................................ ............... ..H............text....=... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............D..............@..B................c]......H.......t...h..............0....\........................................()...*^.()..........%...}....*:.().....}....*:.().....}....*:.().....}....*..s*...*..s+...*:.(,.....(-...*..{....*"..}....*J.(/........(0...&*:.(,.....(1...*..{2...*"..}2...*.0..(........(3......+.............(0...&..X....i2.*v.(,....s4...}.....s5...}....*v.{.....r...p(...+.....o7....*.0...........o8....+..o9......(...+&.o....-....,..o......*..........."........{..........o:...&.......(.....*....0..L...

                                                                                              C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsAuthenticationPackage.dll

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                              Category:dropped
                                                                                              Size (bytes):260168
                                                                                              Entropy (8bit):6.416438906122177
                                                                                              Encrypted:false
                                                                                              SSDEEP:3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
                                                                                              MD5:5ADCB5AE1A1690BE69FD22BDF3C2DB60
                                                                                              SHA1:09A802B06A4387B0F13BF2CDA84F53CA5BDC3785
                                                                                              SHA-256:A5B8F0070201E4F26260AF6A25941EA38BD7042AEFD48CD68B9ACF951FA99EE5
                                                                                              SHA-512:812BE742F26D0C42FDDE20AB4A02F1B47389F8D1ACAA6A5BB3409BA27C64BE444AC06D4129981B48FA02D4C06B526CB5006219541B0786F8F37CF2A183A18A73
                                                                                              Malicious:false
                                                                                              Antivirus:
                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A........................T....................V.......V.......V......................=U......=U......=U$.....=U......Rich....................PE..d.....Qf.........." ...'.^...^.......................................................(....`..........................................e.......f..P................ ......HP..........P%..p............................$..@............p...............................text...t].......^.................. ..`.rdata.......p.......b..............@..@.data....+...........d..............@....pdata... ......."...x..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................

                                                                                              C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsBackstageShell.exe

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                              Category:dropped
                                                                                              Size (bytes):61216
                                                                                              Entropy (8bit):6.31175789874945
                                                                                              Encrypted:false
                                                                                              SSDEEP:1536:SW/+lo6MOc8IoiKWjbNv8DtyQ4RE+TC6VAhVbIF7fIxp:SLlo6dccl9yQGVtFra
                                                                                              MD5:6DF2DEF5E591E2481E42924B327A9F15
                                                                                              SHA1:38EAB6E9D99B5CAEEC9703884D25BE8D811620A9
                                                                                              SHA-256:B6A05985C4CF111B94A4EF83F6974A70BF623431187691F2D4BE0332F3899DA9
                                                                                              SHA-512:5724A20095893B722E280DBF382C9BFBE75DD4707A98594862760CBBD5209C1E55EEAF70AD23FA555D62C7F5E54DE1407FB98FC552F42DCCBA5D60800965C6A5
                                                                                              Malicious:false
                                                                                              Antivirus:
                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...L............."...0.................. ........@.. ....................... ......3]....@.....................................O.......,............... )..............8............................................ ............... ..H............text........ ...................... ..`.rsrc...,...........................@..@.reloc..............................@..B........................H........S......................x.........................................(....*^.(.......a...%...}....*:.(......}....*:.(......}....*:.(......}....*....0..........(....(....(....(....r...p(....o....(....r...p..~....(....(....r9..p..~....(....(.....g~).....(....rY..p.(....&(.....(....s....( ...s....(!...*...0...........(".....(#.....($....s....%.o%...%.o&...%.o'...%s!...o(...%~....o)...}......(....o*...o+....(,.....@...%..(.....o-....s....}.....{...........s/...o0....s....}..

                                                                                              C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsBackstageShell.exe.config

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):266
                                                                                              Entropy (8bit):4.842791478883622
                                                                                              Encrypted:false
                                                                                              SSDEEP:6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
                                                                                              MD5:728175E20FFBCEB46760BB5E1112F38B
                                                                                              SHA1:2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
                                                                                              SHA-256:87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
                                                                                              SHA-512:FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
                                                                                              Malicious:false
                                                                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

                                                                                              C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exe

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                              Category:dropped
                                                                                              Size (bytes):601376
                                                                                              Entropy (8bit):6.185921191564225
                                                                                              Encrypted:false
                                                                                              SSDEEP:6144:r+z3H0n063rDHWP5hLG/6XixJQm16Eod7ZeYai1FzJTZJ5BCEOG6y9QsZSc4F2/Q:qzEjrTWPMLBfWFaSdJ5BeG6xs6/yRod
                                                                                              MD5:20AB8141D958A58AADE5E78671A719BF
                                                                                              SHA1:F914925664AB348081DAFE63594A64597FB2FC43
                                                                                              SHA-256:9CFD2C521D6D41C3A86B6B2C3D9B6A042B84F2F192F988F65062F0E1BFD99CAB
                                                                                              SHA-512:C5DD5ED90C516948D3D8C6DFA3CA7A6C8207F062883BA442D982D8D05A7DB0707AFEC3A0CB211B612D04CCD0B8571184FC7E81B2E98AE129E44C5C0E592A5563
                                                                                              Malicious:false
                                                                                              Yara Hits:
                                                                                              • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exe, Author: Joe Security
                                                                                              Antivirus:
                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...{<............"...0.................. ... ....@.. .......................`.......x....@.................................=...O.... .................. )...@..........8............................................ ............... ..H............text...`.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................q.......H........H................................................................{D...*..{E...*V.(F.....}D.....}E...*...0..A........u1.......4.,/(G....{D....{D...oH...,.(I....{E....{E...oJ...*.*.*. }.o )UU.Z(G....{D...oK...X )UU.Z(I....{E...oL...X*...0..b........r...p......%..{D......%q4....4...-.&.+...4...oM....%..{E......%q5....5...-.&.+...5...oM....(N...*..{O...*..{P...*V.(F.....}O.....}P...*.0..A........u6.......4.,/(G....{O....{O...oH...,.(I....{P....{P...oJ...*.*.*. 1.c. )UU.

                                                                                              C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exe.config

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):266
                                                                                              Entropy (8bit):4.842791478883622
                                                                                              Encrypted:false
                                                                                              SSDEEP:6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
                                                                                              MD5:728175E20FFBCEB46760BB5E1112F38B
                                                                                              SHA1:2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
                                                                                              SHA-256:87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
                                                                                              SHA-512:FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
                                                                                              Malicious:false
                                                                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

                                                                                              C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsCredentialProvider.dll

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                              Category:dropped
                                                                                              Size (bytes):842248
                                                                                              Entropy (8bit):6.268561504485627
                                                                                              Encrypted:false
                                                                                              SSDEEP:12288:q9vy8YABMuiAoPyEIrJs7jBjaau+EAaMVtw:P8Y4MuiAoPyZrJ8jrvDVtw
                                                                                              MD5:BE74AB7A848A2450A06DE33D3026F59E
                                                                                              SHA1:21568DCB44DF019F9FAF049D6676A829323C601E
                                                                                              SHA-256:7A80E8F654B9DDB15DDA59AC404D83DBAF4F6EAFAFA7ECBEFC55506279DE553D
                                                                                              SHA-512:2643D649A642220CEEE121038FE24EA0B86305ED8232A7E5440DFFC78270E2BDA578A619A76C5BB5A5A6FE3D9093E29817C5DF6C5DD7A8FBC2832F87AA21F0CC
                                                                                              Malicious:false
                                                                                              Antivirus:
                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}....}H..}H..}H.d~I..}H.dxIG.}H.dyI..}H..xI..}H..yI..}H..~I..}H..|H8.}H..}H..}H2.}I..}H2..I..}HRich..}H........PE..d.....Gf.........." ...'.P...........H....................................... ......q.....`......................................... ...t....................P...y.......(......,4.....T.......................(.......@............`...............................text....O.......P.................. ..`.rdata...z...`...|...T..............@..@.data....d.......0..................@....pdata...y...P...z..................@..@_RDATA...............z..............@..@.reloc..,4.......6...|..............@..B................................................................................................................................................................................................................................................................

                                                                                              C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsFileManager.exe

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                              Category:dropped
                                                                                              Size (bytes):81696
                                                                                              Entropy (8bit):5.862223562830496
                                                                                              Encrypted:false
                                                                                              SSDEEP:1536:/tytl44RzbwI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7Yp7gxd:8/KukLdUpc
                                                                                              MD5:B1799A5A5C0F64E9D61EE4BA465AFE75
                                                                                              SHA1:7785DA04E98E77FEC7C9E36B8C68864449724D71
                                                                                              SHA-256:7C39E98BEB59D903BC8D60794B1A3C4CE786F7A7AAE3274C69B507EBA94FAA80
                                                                                              SHA-512:AD8C810D7CC3EA5198EE50F0CEB091A9F975276011B13B10A37306052697DC43E58A16C84FA97AB02D3927CD0431F62AEF27E500030607828B2129F305C27BE8
                                                                                              Malicious:false
                                                                                              Antivirus:
                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P............"...0..@...........^... ...`....@.. .......................`......j.....@..................................^..O....`.. ............... )...@.......]..8............................................ ............... ..H............text....>... ...@.................. ..`.rsrc... ....`.......B..............@..@.reloc.......@......................@..B.................^......H....... +..@2..................`]........................................(....*^.(.......;...%...}....*:.(......}....*:.(......}....*:.(......}....*....0..........s>....(....(....(....(....(.....(....(......s....}B....s....}C....~@...%-.&~?.....<...s ...%.@...o...+.....@...s ...o...+......A...s!...o...+}D.......B...s"...o...+.......(#...&......(#...& .... ...........($...&s....t......r...prs..p(%...(&...~>...%-.&...'...s(...%.>.....A...().......(*........(+...o,...(-...t....

                                                                                              C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsFileManager.exe.config

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):266
                                                                                              Entropy (8bit):4.842791478883622
                                                                                              Encrypted:false
                                                                                              SSDEEP:6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
                                                                                              MD5:728175E20FFBCEB46760BB5E1112F38B
                                                                                              SHA1:2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
                                                                                              SHA-256:87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
                                                                                              SHA-512:FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
                                                                                              Malicious:false
                                                                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

                                                                                              C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\app.config

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):1069
                                                                                              Entropy (8bit):4.65211705670758
                                                                                              Encrypted:false
                                                                                              SSDEEP:24:k9hKrGHva/dHvv/dHvFlmo/dHvUmo/dHvZdGHvUfGHvP:Wh6GHS/dHH/dHfh/dH8h/dHRdGHeGHX
                                                                                              MD5:821B213E3E126D5C9DD2414F4D5862DC
                                                                                              SHA1:8BB77BB0C1685584FB00A707706852426A3DBE10
                                                                                              SHA-256:70C24EDB7BF3ECFEB3E7F834B9264A74E47E14BA5D81949DD209D4649DC4418B
                                                                                              SHA-512:E374B1C734FD0475261A5E1EE9965B1A6B3E2E3BA5E64246C64D267EA9ABA21EE22D9841D3A8E7A650A6044CBCBC85EF0565A004CE58959289AB6E7F710C8D4E
                                                                                              Malicious:false
                                                                                              Preview:<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="IsUserAllowedToRequireConsent" serializeAs="String">.. <value>true</value>.. </setting>.. <setting name="AccessShowBalloonOnConnect" serializeAs="String">.. <value>false</value>.. </setting>.. <setting name="SupportShowBalloonOnConnect" serializeAs="String">.. <value>false</value>.. </setting>.. <setting name="SupportHideWallpaperOnConnect" serializeAs="String">.. <value>false</value>.. </setting>.. <setting name="AccessHideWallpaperOnConnect" serializeAs="String">.. <value>false</value>.. </setting>.. <setting name="AutoConsentIfUserProcessNotRunning" serializeAs="String">.. <value>true</value>.. </setting>.. <setting name="AutoConsentToBackstage" serializeAs="String">.. <value>true</value>..

                                                                                              C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\system.config

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:XML 1.0 document, ASCII text, with very long lines (480), with CRLF line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):970
                                                                                              Entropy (8bit):5.75262184940059
                                                                                              Encrypted:false
                                                                                              SSDEEP:24:2dL9hK6E4dl/5Bu1oOfP6kdMl9dmnkvmF3slX8vH:chh7HH5A1oM6kdMnoWmeiv
                                                                                              MD5:E9D8F59E9027990A6115DAF37F0822B8
                                                                                              SHA1:0C394D1156FC1FF4A6ADABF9F4777093EA9651A5
                                                                                              SHA-256:806FA7C9100FD0575EB34DA3079F3A47ACE65C847DAEFCC3DCB799A439119EBA
                                                                                              SHA-512:0EF90A12F83BD88C69596EB646889395E867073550CFCBEEDBEEC3329435AA40E8F0D546C215D5E00A7E6F0E1CB0FFFCF5CC5EE9AF8239FE338D97ACA78B7650
                                                                                              Malicious:false
                                                                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="ClientLaunchParametersConstraint" serializeAs="String">.. <value>?h=instance-f13iq7-relay.screenconnect.com&amp;p=443&amp;k=BgIAAACkAABSU0ExAAgAAAEAAQC1MY9w4B1kmCI8rrVVcN3Qv2pF2incNEaC5%2f57%2frQys%2fxWV8jitTHxen5sI4Wll36RpM9KV99bb78RmSViUCckbjE5KmpupWzSRQPRoXSxvLn2bqJ43r%2b0c1Xzj6wxUS%2bGCdb3y5osDTbAX4izwcSX%2fWd5MibcXFXyV0GDsYs7uPqQNXSNtw1v5PTrV4hH6KEn7iG8xD119OfXklw0j4quXgapgwpI4dZ5E20CIMcRqfPC5dqnBzSKD%2bnQ0l48Ao%2fzM5ObrNV%2f8giwIObi%2f%2b9H0BQvztiy4rypOySEqrH3oVDeR1OWmdV0FGCTguAa5uyNJoKXRLqK4n1ztMQHr%2f%2bi</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                              C:\ProgramData\Microsoft\Network\Downloader\edb.log

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                              File Type:data
                                                                                              Category:dropped
                                                                                              Size (bytes):1310720
                                                                                              Entropy (8bit):0.72630356097936
                                                                                              Encrypted:false
                                                                                              SSDEEP:1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0m:9JZj5MiKNnNhoxuD
                                                                                              MD5:AC2FA697116041843EAFCA6650E4B45E
                                                                                              SHA1:F664F278B13276EEB7787053B6CEB71F7F679E69
                                                                                              SHA-256:8D20248C05645B6867634154C06443DB3F4B989C8CE6567EDA1309760B95FFD4
                                                                                              SHA-512:DE27BDF06779B39E42D54EA3AE69BDB8F6E0DD63813CD672D4A523DB382F7578B34F32A6451D5FDFEB856136E1C7097B9D2CE973F43317A6DBB8E38C0D8196F6
                                                                                              Malicious:false
                                                                                              Preview:...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

                                                                                              C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                              File Type:Extensible storage user DataBase, version 0x620, checksum 0x45e336a3, page size 16384, DirtyShutdown, Windows version 10.0
                                                                                              Category:dropped
                                                                                              Size (bytes):1310720
                                                                                              Entropy (8bit):0.7555099238274657
                                                                                              Encrypted:false
                                                                                              SSDEEP:1536:VSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:VazaSvGJzYj2UlmOlOL
                                                                                              MD5:8BC535A7BC661937C3DFCDD5B473F20B
                                                                                              SHA1:B46A13699D5AFF24315CAD5363F0A2BAEE90BD67
                                                                                              SHA-256:9E7A3A7751508C78288659AB22CEB6E1EA6750E35A8B5F8FAE637A41A1EC1CBD
                                                                                              SHA-512:9C4413DF8249B23AF3DA11B12254A44DDE7B79AFDB97DAD958E563BC350E5AF51D066836285A0F4E4D271E46778D13D65A6E6C15E6F6D91A481067826C4B4E22
                                                                                              Malicious:false
                                                                                              Preview:E.6.... .......7.......X\...;...{......................0.e......!...{?.5....|..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{..................................d..5....|....................5.5....|...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

                                                                                              C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                              File Type:data
                                                                                              Category:dropped
                                                                                              Size (bytes):16384
                                                                                              Entropy (8bit):0.07741038978632797
                                                                                              Encrypted:false
                                                                                              SSDEEP:3:LvltyYenV0c3NaAPaU1lExwwBc//AlluxmO+l/SNxOf:bltyzn1NDPaU8TW/AgmOH
                                                                                              MD5:EB3CBF0F98F54ED05DC4A2695DEDD73C
                                                                                              SHA1:903C06E5F6077E64620192234BF241B5AB3C64B0
                                                                                              SHA-256:737CB408EDA9F26A3B8DC20BC80E9EA5668292371BF7D7203CF751CCBA6A4507
                                                                                              SHA-512:DE652281D14179F2A393B7AEDDDEF9AD6882159FA424A0BC41389FDEADFEE92FA66FA197332500F16A7C509EB8D3B35073E97B5A4A822ED74E8CB53ADBC60798
                                                                                              Malicious:false
                                                                                              Preview:g-J'.....................................;...{..5....|...!...{?..........!...{?..!...{?..g...!...{?...................5.5....|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                              C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ScreenConnect.ClientSetup (1).exe.log

                                                                                              Download File
                                                                                              Process:C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exe
                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):321
                                                                                              Entropy (8bit):5.36509199858051
                                                                                              Encrypted:false
                                                                                              SSDEEP:6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTrM3RJoDLIP12MUAvvR+uCv:Q3La/KDLI4MWuPTArkvoDLI4MWuCv
                                                                                              MD5:1CF2352B684EF57925D98E766BA897F2
                                                                                              SHA1:6E8CB2C1143E9D9D1211BAA811FE4CAA49C08B55
                                                                                              SHA-256:43C3FB3C0B72A899C5442DAC8748D019D800E0A9421D3677EB96E196ED285290
                                                                                              SHA-512:9F2D6F89453C867386A65A04FF96067FC3B23A99A4BCE0ECD227E130F409069FE6DD202D4839CBF204C3F204EC058D6CDFDADA7DD212BC2356D74FEC97F22061
                                                                                              Malicious:true
                                                                                              Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

                                                                                              C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log

                                                                                              Download File
                                                                                              Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):746
                                                                                              Entropy (8bit):5.349174276064173
                                                                                              Encrypted:false
                                                                                              SSDEEP:12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhaOK9eDLI4MNJK9P/JNTK9yirkvoDLb:ML9E4KlKDE4KhKiKhPKIE4oKNzKogE4P
                                                                                              MD5:ED994980CB1AABB953B2C8ECDC745E1F
                                                                                              SHA1:9E9D3E00A69FC862F4D3C30F42BF26693A2D2A21
                                                                                              SHA-256:D23B54CCF9F6327FE1158762D4E5846649699A7B78418D056A197835ED1EBE79
                                                                                              SHA-512:61DFC93154BCD734B9836A6DECF93674499FF533E2B9A1188886E2CBD04DF35538368485AA7E775B641ADC120BAE1AC2551B28647951C592AA77F6747F0E9187
                                                                                              Malicious:false
                                                                                              Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

                                                                                              C:\Users\user\AppData\Local\Temp\MSICF5E.tmp

                                                                                              Download File
                                                                                              Process:C:\Windows\SysWOW64\msiexec.exe
                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive
                                                                                              Category:dropped
                                                                                              Size (bytes):1086792
                                                                                              Entropy (8bit):7.793516535218678
                                                                                              Encrypted:false
                                                                                              SSDEEP:24576:4UUGG/qSDceVjLHGeRdtRiypAxiK7cl72km/4aoczU:bG/XcW32gqkAfosU
                                                                                              MD5:30CA21632F98D354A940903214AE4DE1
                                                                                              SHA1:6C59A3A65FB8E7D4AD96A3E8D90E72B02091D3F4
                                                                                              SHA-256:4BB0E9B5C70E3CAEB955397A4A3B228C0EA5836729202B8D4BA1BE531B60DAFC
                                                                                              SHA-512:47509F092B089EB1FFC115643DCDFBFAC5F50F239DE63ECAD71963EC1D37FF72B89F5A2AEA137ED391BA9BA10947ABBE6103DB1C56032FD6B39A0855CB283509
                                                                                              Malicious:false
                                                                                              Antivirus:
                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S.c.2.0.2.0.2.0..|0.2.0..H0.2.0.Jq0.2.0.2.0.2.0..I0.2.0..y0.2.0..x0.2.0...0.2.0Rich.2.0................PE..L...9..P...........!.........H.......i.......................................p............@..............................*..l...x....@.......................P..d.......................................@...............h............................text............................... ..`.rdata..............................@..@.data....-..........................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                              C:\Users\user\AppData\Local\Temp\MSICF5E.tmp-\CustomAction.config

                                                                                              Download File
                                                                                              Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                              File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):234
                                                                                              Entropy (8bit):4.977464602412109
                                                                                              Encrypted:false
                                                                                              SSDEEP:6:JiMVBdTMkIffVymRMT4/0xC/C7VrfC7VNQpuAW4QIT:MMHd413VymhsS+Qg93xT
                                                                                              MD5:6F52EBEA639FD7CEFCA18D9E5272463E
                                                                                              SHA1:B5E8387C2EB20DD37DF8F4A3B9B0E875FA5415E3
                                                                                              SHA-256:7027B69AB6EBC9F3F7D2F6C800793FDE2A057B76010D8CFD831CF440371B2B23
                                                                                              SHA-512:B5960066430ED40383D39365EADB3688CADADFECA382404924024C908E32C670AFABD37AB41FF9E6AC97491A5EB8B55367D7199002BF8569CF545434AB2F271A
                                                                                              Malicious:false
                                                                                              Preview:.<?xml version="1.0" encoding="utf-8" ?>..<configuration>.. <startup useLegacyV2RuntimeActivationPolicy="true">.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>..</configuration>

                                                                                              C:\Users\user\AppData\Local\Temp\MSICF5E.tmp-\Microsoft.Deployment.Compression.Cab.dll

                                                                                              Download File
                                                                                              Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                              Category:dropped
                                                                                              Size (bytes):49152
                                                                                              Entropy (8bit):4.62694170304723
                                                                                              Encrypted:false
                                                                                              SSDEEP:768:sqbC2wmdVdX9Y6BCH+C/FEQl2ifnxwr02Gy/G4Xux+bgHGvLw4:sAtXPC/Cifnxs02Gyu4Xu0MeR
                                                                                              MD5:77BE59B3DDEF06F08CAA53F0911608A5
                                                                                              SHA1:A3B20667C714E88CC11E845975CD6A3D6410E700
                                                                                              SHA-256:9D32032109FFC217B7DC49390BD01A067A49883843459356EBFB4D29BA696BF8
                                                                                              SHA-512:C718C1AFA95146B89FC5674574F41D994537AF21A388335A38606AEC24D6A222CBCE3E6D971DFE04D86398E607815DF63A54DA2BB96CCF80B4F52072347E1CE6
                                                                                              Malicious:false
                                                                                              Antivirus:
                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F.Y.........." ..0...... ........... ........... ...............................$....@....................................O.................................................................................... ............... ..H............text... .... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                              C:\Users\user\AppData\Local\Temp\MSICF5E.tmp-\Microsoft.Deployment.Compression.dll

                                                                                              Download File
                                                                                              Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                              Category:dropped
                                                                                              Size (bytes):36864
                                                                                              Entropy (8bit):4.340550904466943
                                                                                              Encrypted:false
                                                                                              SSDEEP:384:GqJxldkxhW9N5u8IALLU0X9Z1kTOPJlqE:GqJxl6xsPIA9COxlqE
                                                                                              MD5:4717BCC62EB45D12FFBED3A35BA20E25
                                                                                              SHA1:DA6324A2965C93B70FC9783A44F869A934A9CAF7
                                                                                              SHA-256:E04DE7988A2A39931831977FA22D2A4C39CF3F70211B77B618CAE9243170F1A7
                                                                                              SHA-512:BB0ABC59104435171E27830E094EAE6781D2826ED2FC9009C8779D2CA9399E38EDB1EC6A10C1676A5AF0F7CACFB3F39AC2B45E61BE2C6A8FE0EDB1AF63A739CA
                                                                                              Malicious:false
                                                                                              Antivirus:
                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F.Y.........." ..0..`... .......~... ........... ....................................@.................................X~..O................................... }............................................... ............... ..H............text....^... ...`.................. ..`.rsrc................p..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                              C:\Users\user\AppData\Local\Temp\MSICF5E.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll

                                                                                              Download File
                                                                                              Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                              Category:dropped
                                                                                              Size (bytes):57344
                                                                                              Entropy (8bit):4.657268358041957
                                                                                              Encrypted:false
                                                                                              SSDEEP:768:BLNru62y+VqB4N5SBcDhDxW7ZkCmX2Qv1Sf0AQdleSBRxf+xUI3:BJ2yUGmh2O11AsleyRxf+xt
                                                                                              MD5:A921A2B83B98F02D003D9139FA6BA3D8
                                                                                              SHA1:33D67E11AD96F148FD1BFD4497B4A764D6365867
                                                                                              SHA-256:548C551F6EBC5D829158A1E9AD1948D301D7C921906C3D8D6B6D69925FC624A1
                                                                                              SHA-512:E1D7556DAF571C009FE52D6FFE3D6B79923DAEEA39D754DDF6BEAFA85D7A61F3DB42DFC24D4667E35C4593F4ED6266F4099B393EFA426FA29A72108A0EAEDD3E
                                                                                              Malicious:false
                                                                                              Antivirus:
                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F.Y.........." ..0...... ........... ........... ....................... .......t....@.....................................O...................................`................................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                              C:\Users\user\AppData\Local\Temp\MSICF5E.tmp-\Microsoft.Deployment.WindowsInstaller.dll

                                                                                              Download File
                                                                                              Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                              Category:dropped
                                                                                              Size (bytes):176128
                                                                                              Entropy (8bit):5.775360792482692
                                                                                              Encrypted:false
                                                                                              SSDEEP:3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
                                                                                              MD5:5EF88919012E4A3D8A1E2955DC8C8D81
                                                                                              SHA1:C0CFB830B8F1D990E3836E0BCC786E7972C9ED62
                                                                                              SHA-256:3E54286E348EBD3D70EAED8174CCA500455C3E098CDD1FCCB167BC43D93DB29D
                                                                                              SHA-512:4544565B7D69761F9B4532CC85E7C654E591B2264EB8DA28E60A058151030B53A99D1B2833F11BFC8ACC837EECC44A7D0DBD8BC7AF97FC0E0F4938C43F9C2684
                                                                                              Malicious:false
                                                                                              Antivirus:
                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F.Y.........." ..0...... ......~.... ........... ..............................!|....@.................................,...O.................................................................................... ............... ..H............text....w... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                              C:\Users\user\AppData\Local\Temp\MSICF5E.tmp-\ScreenConnect.Core.dll

                                                                                              Download File
                                                                                              Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                              Category:dropped
                                                                                              Size (bytes):548864
                                                                                              Entropy (8bit):6.031251664661689
                                                                                              Encrypted:false
                                                                                              SSDEEP:6144:7+kYq9xDsxaUGEcANzZ1dkmn27qcO5noYKvKzDrzL9e7eOJsXziIYjVtkb+vbHq+:7SHtpnoVMlUbHbBaYLD
                                                                                              MD5:16C4F1E36895A0FA2B4DA3852085547A
                                                                                              SHA1:AB068A2F4FFD0509213455C79D311F169CD7CAB8
                                                                                              SHA-256:4D4BF19AD99827F63DD74649D8F7244FC8E29330F4D80138C6B64660C8190A53
                                                                                              SHA-512:AB4E67BE339BECA30CAB042C9EBEA599F106E1E0E2EE5A10641BEEF431A960A2E722A459534BDC7C82C54F523B21B4994C2E92AA421650EE4D7E0F6DB28B47BA
                                                                                              Malicious:false
                                                                                              Antivirus:
                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...z............." ..0..X...........r... ........... ...............................D....@..................................r..O....................................q..8............................................ ............... ..H............text....V... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................r......H........B......................xq........................................{:...*..{;...*V.(<.....}:.....};...*...0..A........u~.......4.,/(=....{:....{:...o>...,.(?....{;....{;...o@...*.*.*. ... )UU.Z(=....{:...oA...X )UU.Z(?....{;...oB...X*...0..b........r...p......%..{:......%q.........-.&.+.......oC....%..{;......%q.........-.&.+.......oC....(D...*..{E...*..{F...*V.(<.....}E.....}F...*.0..A........u........4.,/(=....{E....{E...o>...,.(?....{F....{F...o@...*.*.*. F.b# )UU.

                                                                                              C:\Users\user\AppData\Local\Temp\MSICF5E.tmp-\ScreenConnect.InstallerActions.dll

                                                                                              Download File
                                                                                              Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                              Category:dropped
                                                                                              Size (bytes):11776
                                                                                              Entropy (8bit):5.267782165666963
                                                                                              Encrypted:false
                                                                                              SSDEEP:192:TY8/Qp6lCJuV3jnXtyVNamVNG1YZfCrMmbfHJ7kjvLQbuLd9NEFbOhmX:Z/cBJaLXt2NaheUrMmb/FkjvLQbuZZmX
                                                                                              MD5:5060FA094CE77A1DB1BEB4010F3C2306
                                                                                              SHA1:93B017A300C14CEEBA12AFBC23573A42443D861D
                                                                                              SHA-256:25C495FB28889E0C4D378309409E18C77F963337F790FEDFBB13E5CC54A23243
                                                                                              SHA-512:2384A0A8FC158481E969F66958C4B7D370BE4219046AB7D77E93E90F7F1C3815F23B47E76EFD8129234CCCB3BCAC2AA8982831D8745E0B733315C1CCF3B1973D
                                                                                              Malicious:false
                                                                                              Antivirus:
                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...m............." ..0..&..........&E... ...`....... ..............................t.....@..................................D..O....`..............................$D..8............................................ ............... ..H............text...,%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc...............,..............@..B.................E......H........'.......................C........................................(....*^.(.......&...%...}....*:.(......}....*:.(......}....*:.(......}....*....0..........s.......}.....s....}.....{....r...p(......,h.{....r...p......%...(.....rS..p.(....~....%-.&~..........s....%......(...+%-.&+.(...........s....(...+&.{....o....-!.{.....{.....{....rc..po....(.....{....o.........{.....{.....{....r}..po....(.....{....o....-..{....r...p......(.....*.{....s .....-..o!.......{....r}..p.o

                                                                                              C:\Users\user\AppData\Local\Temp\MSICF5E.tmp-\ScreenConnect.Windows.dll

                                                                                              Download File
                                                                                              Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                              Category:dropped
                                                                                              Size (bytes):1721856
                                                                                              Entropy (8bit):6.639136400085158
                                                                                              Encrypted:false
                                                                                              SSDEEP:24576:gx5x94kEFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:gx5xKkEJkGYYpT0+TFiH7efP
                                                                                              MD5:9F823778701969823C5A01EF3ECE57B7
                                                                                              SHA1:DA733F482825EC2D91F9F1186A3F934A2EA21FA1
                                                                                              SHA-256:ABCA7CF12937DA14C9323C880EC490CC0E063D7A3EEF2EAC878CD25C84CF1660
                                                                                              SHA-512:FFC40B16F5EA2124629D797DC3A431BEB929373BFA773C6CDDC21D0DC4105D7360A485EA502CE8EA3B12EE8DCA8275A0EC386EA179093AF3AA8B31B4DD3AE1CA
                                                                                              Malicious:false
                                                                                              Antivirus:
                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l............" ..0..>...........]... ...`....... ..............................[.....@................................./]..O....`...............................\..8............................................ ............... ..H............text....=... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............D..............@..B................c]......H.......t...h..............0....\........................................()...*^.()..........%...}....*:.().....}....*:.().....}....*:.().....}....*..s*...*..s+...*:.(,.....(-...*..{....*"..}....*J.(/........(0...&*:.(,.....(1...*..{2...*"..}2...*.0..(........(3......+.............(0...&..X....i2.*v.(,....s4...}.....s5...}....*v.{.....r...p(...+.....o7....*.0...........o8....+..o9......(...+&.o....-....,..o......*..........."........{..........o:...&.......(.....*....0..L...

                                                                                              C:\Users\user\AppData\Local\Temp\ScreenConnect\ccf23f1afa8af061\setup.msi

                                                                                              Download File
                                                                                              Process:C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exe
                                                                                              File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Default, Author: ScreenConnect Software, Keywords: Default, Comments: Default, Template: Intel;1033, Revision Number: {7C192981-00FA-4F6A-CC5D-8D3B0AD966AA}, Create Time/Date: Tue Aug 13 23:22:20 2024, Last Saved Time/Date: Tue Aug 13 23:22:20 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.0.1701), Security: 2
                                                                                              Category:dropped
                                                                                              Size (bytes):9908224
                                                                                              Entropy (8bit):7.959394006701424
                                                                                              Encrypted:false
                                                                                              SSDEEP:196608:053JLR3LGMLiW35153JLR3LGMLU53JLR3LGMLW53JLR3LGMLV53JLR3LGML:UTiuPT0TaTvT
                                                                                              MD5:10160587A93CFB21C67725D34FB7C632
                                                                                              SHA1:5B798F97762E876DC33EF1EF7315A29871CAAFFD
                                                                                              SHA-256:8BAF68029DEC5A7343E1FF72F15CD42890019F8DC3C62FBD4BA46DBDDE0DFEFB
                                                                                              SHA-512:1EA25A1C1DDE0F7A9FADEEAC6BFC555965AA3150241CBD4AFDB374FC7C91867BCB4F0FCD1445160FFAA0AE11E8F0EDFB0ED8FF7AA69BDA3ACFD071B84D1AFE23
                                                                                              Malicious:false
                                                                                              Preview:......................>.......................................................{...p...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                              C:\Windows\Installer\6ed327.msi

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Default, Author: ScreenConnect Software, Keywords: Default, Comments: Default, Template: Intel;1033, Revision Number: {7C192981-00FA-4F6A-CC5D-8D3B0AD966AA}, Create Time/Date: Tue Aug 13 23:22:20 2024, Last Saved Time/Date: Tue Aug 13 23:22:20 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.0.1701), Security: 2
                                                                                              Category:dropped
                                                                                              Size (bytes):9908224
                                                                                              Entropy (8bit):7.959394006701424
                                                                                              Encrypted:false
                                                                                              SSDEEP:196608:053JLR3LGMLiW35153JLR3LGMLU53JLR3LGMLW53JLR3LGMLV53JLR3LGML:UTiuPT0TaTvT
                                                                                              MD5:10160587A93CFB21C67725D34FB7C632
                                                                                              SHA1:5B798F97762E876DC33EF1EF7315A29871CAAFFD
                                                                                              SHA-256:8BAF68029DEC5A7343E1FF72F15CD42890019F8DC3C62FBD4BA46DBDDE0DFEFB
                                                                                              SHA-512:1EA25A1C1DDE0F7A9FADEEAC6BFC555965AA3150241CBD4AFDB374FC7C91867BCB4F0FCD1445160FFAA0AE11E8F0EDFB0ED8FF7AA69BDA3ACFD071B84D1AFE23
                                                                                              Malicious:false
                                                                                              Preview:......................>.......................................................{...p...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                              C:\Windows\Installer\6ed329.msi

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Default, Author: ScreenConnect Software, Keywords: Default, Comments: Default, Template: Intel;1033, Revision Number: {7C192981-00FA-4F6A-CC5D-8D3B0AD966AA}, Create Time/Date: Tue Aug 13 23:22:20 2024, Last Saved Time/Date: Tue Aug 13 23:22:20 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.0.1701), Security: 2
                                                                                              Category:dropped
                                                                                              Size (bytes):9908224
                                                                                              Entropy (8bit):7.959394006701424
                                                                                              Encrypted:false
                                                                                              SSDEEP:196608:053JLR3LGMLiW35153JLR3LGMLU53JLR3LGMLW53JLR3LGMLV53JLR3LGML:UTiuPT0TaTvT
                                                                                              MD5:10160587A93CFB21C67725D34FB7C632
                                                                                              SHA1:5B798F97762E876DC33EF1EF7315A29871CAAFFD
                                                                                              SHA-256:8BAF68029DEC5A7343E1FF72F15CD42890019F8DC3C62FBD4BA46DBDDE0DFEFB
                                                                                              SHA-512:1EA25A1C1DDE0F7A9FADEEAC6BFC555965AA3150241CBD4AFDB374FC7C91867BCB4F0FCD1445160FFAA0AE11E8F0EDFB0ED8FF7AA69BDA3ACFD071B84D1AFE23
                                                                                              Malicious:false
                                                                                              Preview:......................>.......................................................{...p...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                              C:\Windows\Installer\MSID52B.tmp

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:data
                                                                                              Category:dropped
                                                                                              Size (bytes):423617
                                                                                              Entropy (8bit):6.5772981638815065
                                                                                              Encrypted:false
                                                                                              SSDEEP:12288:UwCJnmXaW4hFqc3LgQWly30uH2anwohwQUv5uH2anwohwQUv4mJ2A:RurhwQUv5urhwQUvH
                                                                                              MD5:5F47AA4AFBBBFBB1DB7CFB7E4AF646FD
                                                                                              SHA1:169CA10BD42F484FDDC9784AB043BBEDFEB6076B
                                                                                              SHA-256:004628FE3D4F610DB222F7C5644A09659320D3C216A76131AEA20125D3FEA429
                                                                                              SHA-512:87978AF1EFB9A25DBC0AD5252667FED951560F8AD6A72E36C1B725D095563F4356DD443F58A26BABC48E7ADD37FDEBF94B6290D1FCFA493990C2B5144A1F0638
                                                                                              Malicious:false
                                                                                              Yara Hits:
                                                                                              • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Windows\Installer\MSID52B.tmp, Author: Joe Security
                                                                                              Preview:...@IXOS.@.....@..BY.@.....@.....@.....@.....@.....@......&.{7C192981-00FA-4F6A-CC5D-8D3B0AD966AA}'.ScreenConnect Client (ccf23f1afa8af061)..setup.msi.@.....@.....@.....@......DefaultIcon..&.{7C192981-00FA-4F6A-CC5D-8D3B0AD966AA}.....@.....@.....@.....@.......@.....@.....@.......@....'.ScreenConnect Client (ccf23f1afa8af061)......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{7DC48333-CC95-5DFB-5E2F-C424ED87B3C4}^.C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.dll.@.......@.....@.....@......&.{709D0D7A-CE6E-4B21-DBC3-9ED12FB054CB}f.C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsBackstageShell.exe.@.......@.....@.....@......&.{336DF891-5830-F1F1-A97E-4C484346DBC5}c.C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsFileManager.exe.@.......@.

                                                                                              C:\Windows\Installer\MSID53B.tmp

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                              Category:dropped
                                                                                              Size (bytes):207360
                                                                                              Entropy (8bit):6.573348437503042
                                                                                              Encrypted:false
                                                                                              SSDEEP:3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
                                                                                              MD5:BA84DD4E0C1408828CCC1DE09F585EDA
                                                                                              SHA1:E8E10065D479F8F591B9885EA8487BC673301298
                                                                                              SHA-256:3CFF4AC91288A0FF0C13278E73B282A64E83D089C5A61A45D483194AB336B852
                                                                                              SHA-512:7A38418F6EE8DBC66FAB2CD5AD8E033E761912EFC465DAA484858D451DA4B8576079FE90FD3B6640410EDC8B3CAC31C57719898134F246F4000D60A252D88290
                                                                                              Malicious:false
                                                                                              Antivirus:
                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                              Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........AF../.../.../.'D..../.'D..../.'D..../...,.../...+.../...*.../......./......./.....n./.*.*.../.*./.../.*...../....../.*.-.../.Rich../.........................PE..L...pG.Y...........!.........L......&.....................................................@.................................P........P..x....................`......P...T...............................@...............<............................text...+........................... ..`.rdata..*...........................@..@.data...."... ......................@....rsrc...x....P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................

                                                                                              C:\Windows\Installer\MSID7CD.tmp

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                              Category:dropped
                                                                                              Size (bytes):207360
                                                                                              Entropy (8bit):6.573348437503042
                                                                                              Encrypted:false
                                                                                              SSDEEP:3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
                                                                                              MD5:BA84DD4E0C1408828CCC1DE09F585EDA
                                                                                              SHA1:E8E10065D479F8F591B9885EA8487BC673301298
                                                                                              SHA-256:3CFF4AC91288A0FF0C13278E73B282A64E83D089C5A61A45D483194AB336B852
                                                                                              SHA-512:7A38418F6EE8DBC66FAB2CD5AD8E033E761912EFC465DAA484858D451DA4B8576079FE90FD3B6640410EDC8B3CAC31C57719898134F246F4000D60A252D88290
                                                                                              Malicious:false
                                                                                              Antivirus:
                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                              Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........AF../.../.../.'D..../.'D..../.'D..../...,.../...+.../...*.../......./......./.....n./.*.*.../.*./.../.*...../....../.*.-.../.Rich../.........................PE..L...pG.Y...........!.........L......&.....................................................@.................................P........P..x....................`......P...T...............................@...............<............................text...+........................... ..`.rdata..*...........................@..@.data...."... ......................@....rsrc...x....P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................

                                                                                              C:\Windows\Installer\SourceHash{7C192981-00FA-4F6A-CC5D-8D3B0AD966AA}

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:Composite Document File V2 Document, Cannot read section info
                                                                                              Category:dropped
                                                                                              Size (bytes):20480
                                                                                              Entropy (8bit):1.1619704231841208
                                                                                              Encrypted:false
                                                                                              SSDEEP:12:JSbX72FjSAGiLIlHVRpMh/7777777777777777777777777vDHFXVYzvlp3Xl0i5:JYQI5cUv6F
                                                                                              MD5:A4452AC076EAE849674A60AB88FADB6C
                                                                                              SHA1:FCD02F0DB0A224E7C13EF8C5C42D3784FB8B3AFD
                                                                                              SHA-256:90BD049896C0E3897CE818EAC7ACFD738D5252F877A03CFCE6A03ECF88ED1F9E
                                                                                              SHA-512:8CDBDA2D16F626C700A81C568C84017C7E8FFC370E23CF463AD863A28C3B38ACEBB75C8B032D07C1030DF9444F1F83A4451A26FF93C8CC851AD68336D90E96EB
                                                                                              Malicious:false
                                                                                              Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                              C:\Windows\Installer\inprogressinstallinfo.ipi

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:Composite Document File V2 Document, Cannot read section info
                                                                                              Category:dropped
                                                                                              Size (bytes):20480
                                                                                              Entropy (8bit):1.821312801363658
                                                                                              Encrypted:false
                                                                                              SSDEEP:48:58Ph/uRc06WX4EnT5e0d5Rqcq56Adu2SiSR2dVrHGiUrgQsosnPyr2Adu2SID:0h/10nTB5MpffSwdR0VY4
                                                                                              MD5:03A991103A54D8CBC2103FDB10F4AE50
                                                                                              SHA1:0C6C6E12F2B5AAC271C9DF50856A6728254BDD96
                                                                                              SHA-256:96E3973B8F59C95421A01A6275A2713F15E6F9EFB97EF0D9B9E462AF59541CF2
                                                                                              SHA-512:BE3D997F04E03CA79D4F6F33ADE3DC9B428E0392BE7B4EA4D5D03B98F90770A83585269D879C661AEA5B4D024FFFDAD05932DE6145AB7BBAE104A430291CBA97
                                                                                              Malicious:false
                                                                                              Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                              C:\Windows\Installer\{7C192981-00FA-4F6A-CC5D-8D3B0AD966AA}\DefaultIcon

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:MS Windows icon resource - 3 icons, 16x16 with PNG image data, 16 x 16, 8-bit colormap, non-interlaced, 4 bits/pixel, 32x32 with PNG image data, 32 x 32, 1-bit colormap, non-interlaced, 4 bits/pixel
                                                                                              Category:dropped
                                                                                              Size (bytes):435
                                                                                              Entropy (8bit):5.289734780210945
                                                                                              Encrypted:false
                                                                                              SSDEEP:12:Kvv/7tghWPjScQZ/Ev/739Jgh5TZYR/v/71XfghNeZ:QOZZq9JOz0dONeZ
                                                                                              MD5:F34D51C3C14D1B4840AE9FF6B70B5D2F
                                                                                              SHA1:C761D3EF26929F173CEB2F8E01C6748EE2249A8A
                                                                                              SHA-256:0DD459D166F037BB8E531EB2ECEB2B79DE8DBBD7597B05A03C40B9E23E51357A
                                                                                              SHA-512:D6EEB5345A5A049A87BFBFBBBEBFBD9FBAEC7014DA41DB1C706E8B16DDEC31561679AAE9E8A0847098807412BD1306B9616C8E6FCFED8683B4F33BD05ADE38D1
                                                                                              Malicious:false
                                                                                              Preview:..............z...6... ..............00..........0....PNG........IHDR.............(-.S....PLTE....22.u......tRNS.@..f..."IDATx.c` .0"...$.(......SC..Q8....9b.i.Xa.....IEND.B`..PNG........IHDR... ... .....I......PLTE....22.u......tRNS.@..f...(IDATx.c`...... ... D.......vb.....A`..(.-s...q....IEND.B`..PNG........IHDR...0...0.....m.k.....PLTE....22.u......tRNS.@..f...+IDATx.c` .......Q...S.@..DQu...4...(.}DQD...3x........IEND.B`.

                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):360001
                                                                                              Entropy (8bit):5.36298004307907
                                                                                              Encrypted:false
                                                                                              SSDEEP:1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26KgauD:zTtbmkExhMJCIpEq
                                                                                              MD5:031CE0C0046892771DA2637112E05366
                                                                                              SHA1:F86C2F8B72F02D34BDFBF3EB6294214690432C00
                                                                                              SHA-256:BB765C59C60000A091E1AF9371396596E3C2BFED7C28C45B11E6B34B58E0A6F7
                                                                                              SHA-512:6806E00BDD36198A07EB69DBC00446E5BBD3C6885E5A87C26A227E372E6E674B75A664928B6CA386D659BAC6A0AAD6503795A7BDA0A9997C2CA94D2AE903EDE1
                                                                                              Malicious:false
                                                                                              Preview:.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

                                                                                              C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                              File Type:JSON data
                                                                                              Category:dropped
                                                                                              Size (bytes):55
                                                                                              Entropy (8bit):4.306461250274409
                                                                                              Encrypted:false
                                                                                              SSDEEP:3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
                                                                                              MD5:DCA83F08D448911A14C22EBCACC5AD57
                                                                                              SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                                                                                              SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                                                                                              SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                                                                                              Malicious:false
                                                                                              Preview:{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

                                                                                              C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ccf23f1afa8af061)\4mlziiez.newcfg

                                                                                              Download File
                                                                                              Process:C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exe
                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):585
                                                                                              Entropy (8bit):5.032898522018641
                                                                                              Encrypted:false
                                                                                              SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONleUEaAm3kbg/vXbAa3xT:2dL9hK6E46YPRya5kbGvH
                                                                                              MD5:B1CC0A552C4AC3E03418FA5D2B57681C
                                                                                              SHA1:D1BCBD5368320FCA53E4A962ADA7604DFC680120
                                                                                              SHA-256:BB16F9091D99708D7E5FF2906D885581C4FCCA916A7673270D8C71300BF15949
                                                                                              SHA-512:48C3A132E060ED778C625B632E9BF207D63C7CFF7729A1F181338CD40573E74B3314AF3AECD46F3076924AA1E81B166DF80206F32AB1E3B73FB61CCA0B87D30D
                                                                                              Malicious:false
                                                                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-f13iq7-relay.screenconnect.com=147.28.146.148-02%2f10%2f2024%2021%3a00%3a51</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                              C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ccf23f1afa8af061)\5im4yx0k.newcfg

                                                                                              Download File
                                                                                              Process:C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exe
                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):585
                                                                                              Entropy (8bit):5.033145549232733
                                                                                              Encrypted:false
                                                                                              SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONleUEaAm3qYw/vXbAa3xT:2dL9hK6E46YPRya5qRvH
                                                                                              MD5:3C6AE2D902866932A3EDD3E6ACDCAF1A
                                                                                              SHA1:9512A61E31DDEFF214B9B257CC4A292167E9FB40
                                                                                              SHA-256:771C9DCE5F27F4E19FB12F341719B5573904629BB031D9FFB855891126B9DDD7
                                                                                              SHA-512:2880B73AF98732CF7C73D37F148B81B78548B5B8F45356D9690BEAB8060B8E56FEBBC12A8EBCFEB341C1736985E2922DFB1A7B38E1DE45836EF53F41B15334FA
                                                                                              Malicious:false
                                                                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-f13iq7-relay.screenconnect.com=147.28.146.148-02%2f10%2f2024%2021%3a02%3a29</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                              C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ccf23f1afa8af061)\fnbyy2ll.newcfg

                                                                                              Download File
                                                                                              Process:C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exe
                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                              Category:modified
                                                                                              Size (bytes):585
                                                                                              Entropy (8bit):5.0330095161490185
                                                                                              Encrypted:false
                                                                                              SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONleUEaAm3Vm/vXbAa3xT:2dL9hK6E46YPRya5KvH
                                                                                              MD5:2FBCAC820FB5616A54ACFD6E8F15FE6C
                                                                                              SHA1:798FFE0703133D4FADAA398717B55E031035C510
                                                                                              SHA-256:AE8F7D3507321FBD07C68B275E571D32B82EBEA1271B64D220D8609B3B9F338A
                                                                                              SHA-512:3AA0388CF6DE5141208C91A7F205B70531B2F0B3886D1F4E14C85C409F1A50E6A11BC4420AAF5617966CB06D5BB6CB53AB44236BCD941A2AA0A81D2CB554032F
                                                                                              Malicious:false
                                                                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-f13iq7-relay.screenconnect.com=147.28.146.148-02%2f10%2f2024%2021%3a03%3a08</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                              C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ccf23f1afa8af061)\hldinm0o.newcfg

                                                                                              Download File
                                                                                              Process:C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exe
                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):585
                                                                                              Entropy (8bit):5.034470632340939
                                                                                              Encrypted:false
                                                                                              SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONleUEaAm3k6v/vXbAa3xT:2dL9hK6E46YPRya5kwvH
                                                                                              MD5:19BDC5F7A2807183E265EDCEEE259B42
                                                                                              SHA1:3200C0E07B99A448FF4BC950CBCD1322F9800BD3
                                                                                              SHA-256:6B209E80774CE8A157C3D0622B718DCB3286D35AB0FBC02BEBF6818C1407D5E9
                                                                                              SHA-512:65ABB56E83115733105940C671CCC3692638C304E0BCDD266837F93C0F9ACFA470EC018EDB7051DB86373F24E6D84E123EF2838254CE1DBCB46C0E5477870B86
                                                                                              Malicious:false
                                                                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-f13iq7-relay.screenconnect.com=147.28.146.148-02%2f10%2f2024%2021%3a00%3a57</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                              C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ccf23f1afa8af061)\ledwk0ar.newcfg

                                                                                              Download File
                                                                                              Process:C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exe
                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):585
                                                                                              Entropy (8bit):5.031959015815023
                                                                                              Encrypted:false
                                                                                              SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONleUEaAm3ife/vXbAa3xT:2dL9hK6E46YPRya5FvH
                                                                                              MD5:804422E6112C73BC45D499F9D8350CD2
                                                                                              SHA1:47BD84706C74D23D56EB9ACCC2D30BE89FC6A0F1
                                                                                              SHA-256:F56A63E109EE084D230A2437FCF75E7F4C5F9CE5CC2617EB7A1FAE48315D95F5
                                                                                              SHA-512:A9F29E23FEBBA7565B4D56D8E200811B8F7BDD27DF482170F986F6BE913AD0EDD053EEC3CB3E8710163EF56228EBC14B1406C7C30940FA490F683A0AAC3E487B
                                                                                              Malicious:false
                                                                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-f13iq7-relay.screenconnect.com=147.28.146.148-02%2f10%2f2024%2021%3a01%3a32</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                              C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ccf23f1afa8af061)\ndtrnucs.newcfg

                                                                                              Download File
                                                                                              Process:C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exe
                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):585
                                                                                              Entropy (8bit):5.0335611127244615
                                                                                              Encrypted:false
                                                                                              SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONleUEaAm3kt/vXbAa3xT:2dL9hK6E46YPRya5kFvH
                                                                                              MD5:A132B744424B738EF0B68F3B4652375E
                                                                                              SHA1:EA941B40051CC0C046B0B4FB969FEAC5E7603DE3
                                                                                              SHA-256:8F5266E940C0686499F0AC608BFE35C46358372B744A5C0FF8AB784E085B5C20
                                                                                              SHA-512:DDF9B24F344B8F150FFF58A86C634E1A190F79921F31721BD40B2091311AF955F59B2A9E9E6E2E37FF4A6CE2ABE71BCCF39C7AC51AFB2FD4F401500E6CE790B5
                                                                                              Malicious:false
                                                                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-f13iq7-relay.screenconnect.com=147.28.146.148-02%2f10%2f2024%2021%3a00%3a54</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                              C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ccf23f1afa8af061)\nhkn5cft.newcfg

                                                                                              Download File
                                                                                              Process:C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exe
                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):585
                                                                                              Entropy (8bit):5.032898522018641
                                                                                              Encrypted:false
                                                                                              SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONleUEaAm3qfv/vXbAa3xT:2dL9hK6E46YPRya5qf3vH
                                                                                              MD5:218446BBE5F11CBB58996E2B34A09DB7
                                                                                              SHA1:7264BAE6C7A7E18F5C83155A62B066293328FBAE
                                                                                              SHA-256:9C38BD792A6DE9B391249FC295BD99E3E006F95BD98F6D36A6B0DDBDD8340C3D
                                                                                              SHA-512:CB1B779DAD852E276A7FB4D8EA8E3533D7DD46A37EE6F874A2D44C04B4B6B1D19B664FCCB369C352141791505EE5D0AD69D73622F93AA1F763FDAD3BF3A370C5
                                                                                              Malicious:false
                                                                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-f13iq7-relay.screenconnect.com=147.28.146.148-02%2f10%2f2024%2021%3a02%3a05</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                              C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ccf23f1afa8af061)\ou2zxzr5.newcfg

                                                                                              Download File
                                                                                              Process:C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exe
                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):585
                                                                                              Entropy (8bit):5.03499224232924
                                                                                              Encrypted:false
                                                                                              SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONleUEaAm3iAw/vXbAa3xT:2dL9hK6E46YPRya59WvH
                                                                                              MD5:9780DF5ED46129E3EEFC34CDDB041164
                                                                                              SHA1:A749CEF5CB9FA67B0C309E9AACB55F7A770CD7AD
                                                                                              SHA-256:F4127C6E63D1B69B76F7925FE53EC2E7B2EE827EFB077CCC9C5F1C18E608E29B
                                                                                              SHA-512:AC134D77601719688FE8BF8535EFE977F35D16CB237A1709497F4F531F8BE08CA1A5FF6431721C1C4762DC80E0217817256B6984AC2FDA9092357812DC99054C
                                                                                              Malicious:false
                                                                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-f13iq7-relay.screenconnect.com=147.28.146.148-02%2f10%2f2024%2021%3a01%3a39</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                              C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ccf23f1afa8af061)\snbxiz2y.newcfg

                                                                                              Download File
                                                                                              Process:C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exe
                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):585
                                                                                              Entropy (8bit):5.032898522018641
                                                                                              Encrypted:false
                                                                                              SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONleUEaAm3iL05/vXbAa3xT:2dL9hK6E46YPRya5AEvH
                                                                                              MD5:4E7DD5753EF708AD273733A620A65E1E
                                                                                              SHA1:C0037FF24633EF75B2B1E3CB88D63A735D91E788
                                                                                              SHA-256:72896130C5EDAF85AFE697FBA357E86F0919C3C6B2FD2F95EE36094399ED0E98
                                                                                              SHA-512:6AEF5E05DE2C33686B02F0DD1F7F0874E7C1406A518E752213794580FD0A222DA5104F0BD508FA184CF79B9F131CB4590D286B957B8F23E76B3B2AAAE9F32BAE
                                                                                              Malicious:false
                                                                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-f13iq7-relay.screenconnect.com=147.28.146.148-02%2f10%2f2024%2021%3a01%3a50</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                              C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ccf23f1afa8af061)\user.config (copy)

                                                                                              Download File
                                                                                              Process:C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exe
                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):585
                                                                                              Entropy (8bit):5.032898522018641
                                                                                              Encrypted:false
                                                                                              SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONleUEaAm3kbg/vXbAa3xT:2dL9hK6E46YPRya5kbGvH
                                                                                              MD5:B1CC0A552C4AC3E03418FA5D2B57681C
                                                                                              SHA1:D1BCBD5368320FCA53E4A962ADA7604DFC680120
                                                                                              SHA-256:BB16F9091D99708D7E5FF2906D885581C4FCCA916A7673270D8C71300BF15949
                                                                                              SHA-512:48C3A132E060ED778C625B632E9BF207D63C7CFF7729A1F181338CD40573E74B3314AF3AECD46F3076924AA1E81B166DF80206F32AB1E3B73FB61CCA0B87D30D
                                                                                              Malicious:false
                                                                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-f13iq7-relay.screenconnect.com=147.28.146.148-02%2f10%2f2024%2021%3a00%3a51</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                              C:\Windows\Temp\~DF1C8E99E63545DD09.TMP

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:Composite Document File V2 Document, Cannot read section info
                                                                                              Category:dropped
                                                                                              Size (bytes):32768
                                                                                              Entropy (8bit):1.4360708142521268
                                                                                              Encrypted:false
                                                                                              SSDEEP:48:sanuOM+xFX4bT5hUpS0d5Rqcq56Adu2SiSR2dVrHGiUrgQsosnPyr2Adu2SID:Pnx4TXeb5MpffSwdR0VY4
                                                                                              MD5:DB661E9C18C4DE301B60DF373CEC1AFE
                                                                                              SHA1:42D9CEE44EBC0DBB3AE18E48FD20B60D8C46C79E
                                                                                              SHA-256:AFC1C0551402076F77113961884F3D7C879D78AD8F8D3FD26989A0F0A293C80E
                                                                                              SHA-512:EE00277263B14986B9D9EE9942A5C755D3705D4D7EB3299BED48E5532415CA80506B3624BE98D3E3D6501CCE95C44424C0B8B810C96C85EDA2235370ECC31330
                                                                                              Malicious:false
                                                                                              Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                              C:\Windows\Temp\~DF37F34072B0149A5B.TMP

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:Composite Document File V2 Document, Cannot read section info
                                                                                              Category:dropped
                                                                                              Size (bytes):20480
                                                                                              Entropy (8bit):1.821312801363658
                                                                                              Encrypted:false
                                                                                              SSDEEP:48:58Ph/uRc06WX4EnT5e0d5Rqcq56Adu2SiSR2dVrHGiUrgQsosnPyr2Adu2SID:0h/10nTB5MpffSwdR0VY4
                                                                                              MD5:03A991103A54D8CBC2103FDB10F4AE50
                                                                                              SHA1:0C6C6E12F2B5AAC271C9DF50856A6728254BDD96
                                                                                              SHA-256:96E3973B8F59C95421A01A6275A2713F15E6F9EFB97EF0D9B9E462AF59541CF2
                                                                                              SHA-512:BE3D997F04E03CA79D4F6F33ADE3DC9B428E0392BE7B4EA4D5D03B98F90770A83585269D879C661AEA5B4D024FFFDAD05932DE6145AB7BBAE104A430291CBA97
                                                                                              Malicious:false
                                                                                              Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                              C:\Windows\Temp\~DF3BD3E6D47F5DADCA.TMP

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:data
                                                                                              Category:dropped
                                                                                              Size (bytes):512
                                                                                              Entropy (8bit):0.0
                                                                                              Encrypted:false
                                                                                              SSDEEP:3::
                                                                                              MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                              SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                              SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                              SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                              Malicious:false
                                                                                              Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                              C:\Windows\Temp\~DF4D375C5AF091B163.TMP

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:data
                                                                                              Category:dropped
                                                                                              Size (bytes):512
                                                                                              Entropy (8bit):0.0
                                                                                              Encrypted:false
                                                                                              SSDEEP:3::
                                                                                              MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                              SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                              SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                              SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                              Malicious:false
                                                                                              Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                              C:\Windows\Temp\~DF565E6EC348A37150.TMP

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:data
                                                                                              Category:dropped
                                                                                              Size (bytes):512
                                                                                              Entropy (8bit):0.0
                                                                                              Encrypted:false
                                                                                              SSDEEP:3::
                                                                                              MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                              SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                              SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                              SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                              Malicious:false
                                                                                              Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                              C:\Windows\Temp\~DF656821DCA6CB9E3B.TMP

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:data
                                                                                              Category:dropped
                                                                                              Size (bytes):512
                                                                                              Entropy (8bit):0.0
                                                                                              Encrypted:false
                                                                                              SSDEEP:3::
                                                                                              MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                              SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                              SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                              SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                              Malicious:false
                                                                                              Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                              C:\Windows\Temp\~DFA871CDFCC1757634.TMP

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:data
                                                                                              Category:dropped
                                                                                              Size (bytes):512
                                                                                              Entropy (8bit):0.0
                                                                                              Encrypted:false
                                                                                              SSDEEP:3::
                                                                                              MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                              SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                              SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                              SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                              Malicious:false
                                                                                              Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                              C:\Windows\Temp\~DFC1239B7D2C0D35B7.TMP

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:Composite Document File V2 Document, Cannot read section info
                                                                                              Category:dropped
                                                                                              Size (bytes):32768
                                                                                              Entropy (8bit):1.4360708142521268
                                                                                              Encrypted:false
                                                                                              SSDEEP:48:sanuOM+xFX4bT5hUpS0d5Rqcq56Adu2SiSR2dVrHGiUrgQsosnPyr2Adu2SID:Pnx4TXeb5MpffSwdR0VY4
                                                                                              MD5:DB661E9C18C4DE301B60DF373CEC1AFE
                                                                                              SHA1:42D9CEE44EBC0DBB3AE18E48FD20B60D8C46C79E
                                                                                              SHA-256:AFC1C0551402076F77113961884F3D7C879D78AD8F8D3FD26989A0F0A293C80E
                                                                                              SHA-512:EE00277263B14986B9D9EE9942A5C755D3705D4D7EB3299BED48E5532415CA80506B3624BE98D3E3D6501CCE95C44424C0B8B810C96C85EDA2235370ECC31330
                                                                                              Malicious:false
                                                                                              Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                              C:\Windows\Temp\~DFCB2574F80E1CAEF6.TMP

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:data
                                                                                              Category:dropped
                                                                                              Size (bytes):69632
                                                                                              Entropy (8bit):0.24305715827287436
                                                                                              Encrypted:false
                                                                                              SSDEEP:48:CDBAdu2S3qcq56Adu2SiSR2dVrHGiUrgQsosnPyr95k0:bxpffSwdR0VYS5
                                                                                              MD5:11C229E00BCF0B75B665A9E302056EF3
                                                                                              SHA1:75D36DC405ABB0DB95EDA0882E5CA6A7370B8C33
                                                                                              SHA-256:889C395A6989033BE920CD0745E367B3F887437E33B14E2E5B46B31835556060
                                                                                              SHA-512:A5B83A77DF3450EC466CA8E9FABC3BF6B6F7696F7869269874830BDAF135ABC8955514DE22DA94E4096FB9DAD5D519E7C9EF4067C80F2E4102AB1FBEDC6BD9AD
                                                                                              Malicious:false
                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                              C:\Windows\Temp\~DFD88D20DBC440ACAD.TMP

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:Composite Document File V2 Document, Cannot read section info
                                                                                              Category:dropped
                                                                                              Size (bytes):32768
                                                                                              Entropy (8bit):1.4360708142521268
                                                                                              Encrypted:false
                                                                                              SSDEEP:48:sanuOM+xFX4bT5hUpS0d5Rqcq56Adu2SiSR2dVrHGiUrgQsosnPyr2Adu2SID:Pnx4TXeb5MpffSwdR0VY4
                                                                                              MD5:DB661E9C18C4DE301B60DF373CEC1AFE
                                                                                              SHA1:42D9CEE44EBC0DBB3AE18E48FD20B60D8C46C79E
                                                                                              SHA-256:AFC1C0551402076F77113961884F3D7C879D78AD8F8D3FD26989A0F0A293C80E
                                                                                              SHA-512:EE00277263B14986B9D9EE9942A5C755D3705D4D7EB3299BED48E5532415CA80506B3624BE98D3E3D6501CCE95C44424C0B8B810C96C85EDA2235370ECC31330
                                                                                              Malicious:false
                                                                                              Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                              C:\Windows\Temp\~DFE2FA5B54689649C6.TMP

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:data
                                                                                              Category:dropped
                                                                                              Size (bytes):32768
                                                                                              Entropy (8bit):0.069324921701594
                                                                                              Encrypted:false
                                                                                              SSDEEP:6:2/9LG7iVCnLG7iVrKOzPLHKOXVYH7jTqlWGyVky6l3X:2F0i8n0itFzDHFXVYzvE3X
                                                                                              MD5:958AD6E4B9AA9C5E756AFF140E495D65
                                                                                              SHA1:3390AD96BA7580E3245CC9EDF5D039D1AD03C9A2
                                                                                              SHA-256:521437C43E30D12A88FD4CA0CFAAF212B98CC55770AC3F254521A726622D2D73
                                                                                              SHA-512:75F9A4D89B1FA88EF56D5F3E70AAEBAA571A8168EF0019EC6AC749AC6012BA311A68501FD25FAB6D3809D9641BEED66A0E82ECB628D1EDB0BCDEA5BD6D6BFDBE
                                                                                              Malicious:false
                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                              C:\Windows\Temp\~DFEFAF8787C3EE109D.TMP

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\msiexec.exe
                                                                                              File Type:Composite Document File V2 Document, Cannot read section info
                                                                                              Category:dropped
                                                                                              Size (bytes):20480
                                                                                              Entropy (8bit):1.821312801363658
                                                                                              Encrypted:false
                                                                                              SSDEEP:48:58Ph/uRc06WX4EnT5e0d5Rqcq56Adu2SiSR2dVrHGiUrgQsosnPyr2Adu2SID:0h/10nTB5MpffSwdR0VY4
                                                                                              MD5:03A991103A54D8CBC2103FDB10F4AE50
                                                                                              SHA1:0C6C6E12F2B5AAC271C9DF50856A6728254BDD96
                                                                                              SHA-256:96E3973B8F59C95421A01A6275A2713F15E6F9EFB97EF0D9B9E462AF59541CF2
                                                                                              SHA-512:BE3D997F04E03CA79D4F6F33ADE3DC9B428E0392BE7B4EA4D5D03B98F90770A83585269D879C661AEA5B4D024FFFDAD05932DE6145AB7BBAE104A430291CBA97
                                                                                              Malicious:false
                                                                                              Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                              Static File Info

                                                                                              General

                                                                                              File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                              Entropy (8bit):7.4260623728016055
                                                                                              TrID:
                                                                                              • Win32 Executable (generic) Net Framework (10011505/4) 50.01%
                                                                                              • Win32 Executable (generic) a (10002005/4) 49.97%
                                                                                              • Generic Win/DOS Executable (2004/3) 0.01%
                                                                                              • DOS Executable Generic (2002/1) 0.01%
                                                                                              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                              File name:ScreenConnect.ClientSetup (1).exe
                                                                                              File size:5'621'320 bytes
                                                                                              MD5:2fbf1296c804795cd2f5e0a301307472
                                                                                              SHA1:e13a457725b54359e6b7f75d496490efc650c48c
                                                                                              SHA256:4fc0719c59038e56d10d8b979a40636005aa39e57e3588a0d2a660285c53f9b5
                                                                                              SHA512:3fdde72490f939df9e0e15cc818949b57ee8e784eb00f17c4e32e5c44a8566cb7190130850a395ec069aa60e09677805bda7b0456bed47a061c49797dc7d3754
                                                                                              SSDEEP:49152:rDex5xKkEJkGYYpT0+TFiH7efP0x58IJL+md3rHgDNMKLo8SsxG/XcW32gqkAfoO:54s6efPQ53JLbd3LINMLaGUW39f0
                                                                                              TLSH:9946E111B3DA95B9D0BF053CD87A52699A74BC048722C7AF57D4BD292D32BC04E323B6
                                                                                              File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_..E>`.E>`.E>`.....O>`.....?>`.....]>`..Ee.`>`..Ed.T>`..Ec.Q>`.LF..A>`.[l..F>`.E>a.%>`..Ei.D>`..E..D>`..Eb.D>`.RichE>`........

                                                                                              File Icon

                                                                                              Icon Hash:00928e8e8686b000

                                                                                              Static PE Info

                                                                                              General

                                                                                              Entrypoint:0x4014ad
                                                                                              Entrypoint Section:.text
                                                                                              Digitally signed:true
                                                                                              Imagebase:0x400000
                                                                                              Subsystem:windows gui
                                                                                              Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                              DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                                                              Time Stamp:0x6377E6AC [Fri Nov 18 20:10:20 2022 UTC]
                                                                                              TLS Callbacks:
                                                                                              CLR (.Net) Version:
                                                                                              OS Version Major:5
                                                                                              OS Version Minor:1
                                                                                              File Version Major:5
                                                                                              File Version Minor:1
                                                                                              Subsystem Version Major:5
                                                                                              Subsystem Version Minor:1
                                                                                              Import Hash:9771ee6344923fa220489ab01239bdfd

                                                                                              Authenticode Signature

                                                                                              Signature Valid:true
                                                                                              Signature Issuer:CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
                                                                                              Signature Validation Error:The operation completed successfully
                                                                                              Error Number:0
                                                                                              Not Before, Not After
                                                                                              • 17/08/2022 02:00:00 16/08/2025 01:59:59
                                                                                              Subject Chain
                                                                                              • CN="Connectwise, LLC", O="Connectwise, LLC", L=Tampa, S=Florida, C=US
                                                                                              Version:3
                                                                                              Thumbprint MD5:AAE704EC2810686C3BF7704E660AFB5D
                                                                                              Thumbprint SHA-1:4C2272FBA7A7380F55E2A424E9E624AEE1C14579
                                                                                              Thumbprint SHA-256:82B4E7924D5BED84FB16DDF8391936EB301479CEC707DC14E23BC22B8CDEAE28
                                                                                              Serial:0B9360051BCCF66642998998D5BA97CE

                                                                                              Entrypoint Preview

                                                                                              Instruction
                                                                                              call 00007F1C44C9A50Ah
                                                                                              jmp 00007F1C44C99FBFh
                                                                                              push ebp
                                                                                              mov ebp, esp
                                                                                              push 00000000h
                                                                                              call dword ptr [0040D040h]
                                                                                              push dword ptr [ebp+08h]
                                                                                              call dword ptr [0040D03Ch]
                                                                                              push C0000409h
                                                                                              call dword ptr [0040D044h]
                                                                                              push eax
                                                                                              call dword ptr [0040D048h]
                                                                                              pop ebp
                                                                                              ret
                                                                                              push ebp
                                                                                              mov ebp, esp
                                                                                              sub esp, 00000324h
                                                                                              push 00000017h
                                                                                              call dword ptr [0040D04Ch]
                                                                                              test eax, eax
                                                                                              je 00007F1C44C9A147h
                                                                                              push 00000002h
                                                                                              pop ecx
                                                                                              int 29h
                                                                                              mov dword ptr [004148D8h], eax
                                                                                              mov dword ptr [004148D4h], ecx
                                                                                              mov dword ptr [004148D0h], edx
                                                                                              mov dword ptr [004148CCh], ebx
                                                                                              mov dword ptr [004148C8h], esi
                                                                                              mov dword ptr [004148C4h], edi
                                                                                              mov word ptr [004148F0h], ss
                                                                                              mov word ptr [004148E4h], cs
                                                                                              mov word ptr [004148C0h], ds
                                                                                              mov word ptr [004148BCh], es
                                                                                              mov word ptr [004148B8h], fs
                                                                                              mov word ptr [004148B4h], gs
                                                                                              pushfd
                                                                                              pop dword ptr [004148E8h]
                                                                                              mov eax, dword ptr [ebp+00h]
                                                                                              mov dword ptr [004148DCh], eax
                                                                                              mov eax, dword ptr [ebp+04h]
                                                                                              mov dword ptr [004148E0h], eax
                                                                                              lea eax, dword ptr [ebp+08h]
                                                                                              mov dword ptr [004148ECh], eax
                                                                                              mov eax, dword ptr [ebp-00000324h]
                                                                                              mov dword ptr [00414828h], 00010001h

                                                                                              Rich Headers

                                                                                              Programming Language:
                                                                                              • [IMP] VS2008 SP1 build 30729
                                                                                              • [IMP] VS2008 build 21022

                                                                                              Data Directories

                                                                                              NameVirtual AddressVirtual Size Is in Section
                                                                                              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_IMPORT0x129c40x50.rdata
                                                                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0x160000x533080.rsrc
                                                                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x5462000x16448
                                                                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x54a0000xea8.reloc
                                                                                              IMAGE_DIRECTORY_ENTRY_DEBUG0x11f200x70.rdata
                                                                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x11e600x40.rdata
                                                                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_IAT0xd0000x13c.rdata
                                                                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                              Sections

                                                                                              NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                              .text0x10000xb1af0xb200d9fa6da0baf4b869720be833223490cbFalse0.6123156601123596data6.592039633797327IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                              .rdata0xd0000x60780x62008b45a1035c0de72f910a75db7749f735False0.41549744897959184data4.786621464556291IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                              .data0x140000x11e40x8001f4cc86b6735a74429c9d1feb93e2871False0.18310546875data2.265083745848167IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                              .rsrc0x160000x5330800x5332000cb59c276652808eb7200fdad38bae5bunknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                              .reloc0x54a0000xea80x1000a93b0f39998e1e69e5944da8c5ff06b1False0.72265625data6.301490309336801IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                              Resources

                                                                                              NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                              FILES0x163d80x86000PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows0.39622565881529853
                                                                                              FILES0x9c3d80x1a4600PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows0.5111637115478516
                                                                                              FILES0x2409d80x1ac00PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows0.4415614047897196
                                                                                              FILES0x25b5d80x2ec320PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows0.9812068939208984
                                                                                              FILES0x5478f80x1600PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows0.3908025568181818
                                                                                              RT_MANIFEST0x548ef80x188XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.5892857142857143

                                                                                              Imports

                                                                                              DLLImport
                                                                                              mscoree.dllCorBindToRuntimeEx
                                                                                              KERNEL32.dllGetModuleFileNameA, DecodePointer, SizeofResource, LockResource, LoadLibraryW, LoadResource, FindResourceW, GetProcAddress, WriteConsoleW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, FlushFileBuffers, HeapReAlloc, HeapSize, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, RtlUnwind, GetLastError, SetLastError, EncodePointer, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, RaiseException, GetStdHandle, WriteFile, CreateFileW, MultiByteToWideChar, WideCharToMultiByte, ExitProcess, GetModuleHandleExW, GetACP, CloseHandle, HeapAlloc, HeapFree, FindClose, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, LCMapStringW, SetStdHandle, GetFileType, GetStringTypeW, GetProcessHeap
                                                                                              OLEAUT32.dllVariantInit, SafeArrayUnaccessData, SafeArrayCreateVector, SafeArrayDestroy, VariantClear, SafeArrayAccessData

                                                                                              Possible Origin

                                                                                              Language of compilation systemCountry where language is spokenMap
                                                                                              EnglishUnited States

                                                                                              Network Behavior

                                                                                              Network Port Distribution

                                                                                              TCP Packets

                                                                                              TimestampSource PortDest PortSource IPDest IP
                                                                                              Oct 2, 2024 23:00:52.563524008 CEST49712443192.168.2.6147.28.146.148
                                                                                              Oct 2, 2024 23:00:52.563585043 CEST44349712147.28.146.148192.168.2.6
                                                                                              Oct 2, 2024 23:00:52.563673019 CEST49712443192.168.2.6147.28.146.148
                                                                                              Oct 2, 2024 23:00:53.298285961 CEST49712443192.168.2.6147.28.146.148
                                                                                              Oct 2, 2024 23:00:53.298327923 CEST44349712147.28.146.148192.168.2.6
                                                                                              Oct 2, 2024 23:00:53.298414946 CEST44349712147.28.146.148192.168.2.6
                                                                                              Oct 2, 2024 23:00:55.412218094 CEST49715443192.168.2.6147.28.146.148
                                                                                              Oct 2, 2024 23:00:55.412317991 CEST44349715147.28.146.148192.168.2.6
                                                                                              Oct 2, 2024 23:00:55.412403107 CEST49715443192.168.2.6147.28.146.148
                                                                                              Oct 2, 2024 23:00:55.416280031 CEST49715443192.168.2.6147.28.146.148
                                                                                              Oct 2, 2024 23:00:55.416317940 CEST44349715147.28.146.148192.168.2.6
                                                                                              Oct 2, 2024 23:00:55.416369915 CEST44349715147.28.146.148192.168.2.6
                                                                                              Oct 2, 2024 23:00:58.634589911 CEST49718443192.168.2.6147.28.146.148
                                                                                              Oct 2, 2024 23:00:58.634618044 CEST44349718147.28.146.148192.168.2.6
                                                                                              Oct 2, 2024 23:00:58.634845018 CEST49718443192.168.2.6147.28.146.148
                                                                                              Oct 2, 2024 23:00:58.636900902 CEST49718443192.168.2.6147.28.146.148
                                                                                              Oct 2, 2024 23:00:58.636915922 CEST44349718147.28.146.148192.168.2.6
                                                                                              Oct 2, 2024 23:00:58.636976957 CEST44349718147.28.146.148192.168.2.6
                                                                                              Oct 2, 2024 23:01:03.151789904 CEST49723443192.168.2.6147.28.146.148
                                                                                              Oct 2, 2024 23:01:03.151827097 CEST44349723147.28.146.148192.168.2.6
                                                                                              Oct 2, 2024 23:01:03.151902914 CEST49723443192.168.2.6147.28.146.148
                                                                                              Oct 2, 2024 23:01:03.154850960 CEST49723443192.168.2.6147.28.146.148
                                                                                              Oct 2, 2024 23:01:03.154875040 CEST44349723147.28.146.148192.168.2.6
                                                                                              Oct 2, 2024 23:01:03.154927015 CEST44349723147.28.146.148192.168.2.6
                                                                                              Oct 2, 2024 23:01:11.007340908 CEST49727443192.168.2.6147.28.146.148
                                                                                              Oct 2, 2024 23:01:11.007369041 CEST44349727147.28.146.148192.168.2.6
                                                                                              Oct 2, 2024 23:01:11.007464886 CEST49727443192.168.2.6147.28.146.148
                                                                                              Oct 2, 2024 23:01:11.010596991 CEST49727443192.168.2.6147.28.146.148
                                                                                              Oct 2, 2024 23:01:11.010608912 CEST44349727147.28.146.148192.168.2.6
                                                                                              Oct 2, 2024 23:01:11.010812044 CEST44349727147.28.146.148192.168.2.6
                                                                                              Oct 2, 2024 23:01:21.217947006 CEST49728443192.168.2.6147.28.146.148
                                                                                              Oct 2, 2024 23:01:21.218046904 CEST44349728147.28.146.148192.168.2.6
                                                                                              Oct 2, 2024 23:01:21.218151093 CEST49728443192.168.2.6147.28.146.148
                                                                                              Oct 2, 2024 23:01:21.220478058 CEST49728443192.168.2.6147.28.146.148
                                                                                              Oct 2, 2024 23:01:21.220514059 CEST44349728147.28.146.148192.168.2.6
                                                                                              Oct 2, 2024 23:01:21.220578909 CEST44349728147.28.146.148192.168.2.6
                                                                                              Oct 2, 2024 23:01:36.389733076 CEST49730443192.168.2.6147.28.146.148
                                                                                              Oct 2, 2024 23:01:36.389785051 CEST44349730147.28.146.148192.168.2.6
                                                                                              Oct 2, 2024 23:01:36.389888048 CEST49730443192.168.2.6147.28.146.148
                                                                                              Oct 2, 2024 23:01:36.392031908 CEST49730443192.168.2.6147.28.146.148
                                                                                              Oct 2, 2024 23:01:36.392044067 CEST44349730147.28.146.148192.168.2.6
                                                                                              Oct 2, 2024 23:01:36.392093897 CEST44349730147.28.146.148192.168.2.6
                                                                                              Oct 2, 2024 23:02:01.035234928 CEST49733443192.168.2.6147.28.146.148
                                                                                              Oct 2, 2024 23:02:01.035330057 CEST44349733147.28.146.148192.168.2.6
                                                                                              Oct 2, 2024 23:02:01.035424948 CEST49733443192.168.2.6147.28.146.148
                                                                                              Oct 2, 2024 23:02:01.037646055 CEST49733443192.168.2.6147.28.146.148
                                                                                              Oct 2, 2024 23:02:01.037684917 CEST44349733147.28.146.148192.168.2.6
                                                                                              Oct 2, 2024 23:02:01.037781000 CEST44349733147.28.146.148192.168.2.6
                                                                                              Oct 2, 2024 23:02:39.976500034 CEST49736443192.168.2.6147.28.146.148
                                                                                              Oct 2, 2024 23:02:39.976605892 CEST44349736147.28.146.148192.168.2.6
                                                                                              Oct 2, 2024 23:02:39.976700068 CEST49736443192.168.2.6147.28.146.148
                                                                                              Oct 2, 2024 23:02:39.978894949 CEST49736443192.168.2.6147.28.146.148
                                                                                              Oct 2, 2024 23:02:39.978955984 CEST44349736147.28.146.148192.168.2.6
                                                                                              Oct 2, 2024 23:02:39.979015112 CEST44349736147.28.146.148192.168.2.6

                                                                                              UDP Packets

                                                                                              TimestampSource PortDest PortSource IPDest IP
                                                                                              Oct 2, 2024 23:00:52.479118109 CEST5446253192.168.2.61.1.1.1
                                                                                              Oct 2, 2024 23:00:52.534512997 CEST53544621.1.1.1192.168.2.6
                                                                                              Oct 2, 2024 23:01:36.347270012 CEST5109953192.168.2.61.1.1.1
                                                                                              Oct 2, 2024 23:01:36.377346039 CEST53510991.1.1.1192.168.2.6
                                                                                              Oct 2, 2024 23:02:39.929677010 CEST5633553192.168.2.61.1.1.1
                                                                                              Oct 2, 2024 23:02:39.958837032 CEST53563351.1.1.1192.168.2.6

                                                                                              DNS Queries

                                                                                              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                              Oct 2, 2024 23:00:52.479118109 CEST192.168.2.61.1.1.10x1023Standard query (0)instance-f13iq7-relay.screenconnect.comA (IP address)IN (0x0001)false
                                                                                              Oct 2, 2024 23:01:36.347270012 CEST192.168.2.61.1.1.10x126bStandard query (0)instance-f13iq7-relay.screenconnect.comA (IP address)IN (0x0001)false
                                                                                              Oct 2, 2024 23:02:39.929677010 CEST192.168.2.61.1.1.10x10e3Standard query (0)instance-f13iq7-relay.screenconnect.comA (IP address)IN (0x0001)false

                                                                                              DNS Answers

                                                                                              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                              Oct 2, 2024 23:00:52.534512997 CEST1.1.1.1192.168.2.60x1023No error (0)instance-f13iq7-relay.screenconnect.comserver-nix282c8ff2-relay.screenconnect.comCNAME (Canonical name)IN (0x0001)false
                                                                                              Oct 2, 2024 23:00:52.534512997 CEST1.1.1.1192.168.2.60x1023No error (0)server-nix282c8ff2-relay.screenconnect.com147.28.146.148A (IP address)IN (0x0001)false
                                                                                              Oct 2, 2024 23:01:36.377346039 CEST1.1.1.1192.168.2.60x126bNo error (0)instance-f13iq7-relay.screenconnect.comserver-nix282c8ff2-relay.screenconnect.comCNAME (Canonical name)IN (0x0001)false
                                                                                              Oct 2, 2024 23:01:36.377346039 CEST1.1.1.1192.168.2.60x126bNo error (0)server-nix282c8ff2-relay.screenconnect.com147.28.146.148A (IP address)IN (0x0001)false
                                                                                              Oct 2, 2024 23:02:39.958837032 CEST1.1.1.1192.168.2.60x10e3No error (0)instance-f13iq7-relay.screenconnect.comserver-nix282c8ff2-relay.screenconnect.comCNAME (Canonical name)IN (0x0001)false
                                                                                              Oct 2, 2024 23:02:39.958837032 CEST1.1.1.1192.168.2.60x10e3No error (0)server-nix282c8ff2-relay.screenconnect.com147.28.146.148A (IP address)IN (0x0001)false

                                                                                              Statistics

                                                                                              CPU Usage

                                                                                              Click to jump to process

                                                                                              Memory Usage

                                                                                              Click to jump to process

                                                                                              High Level Behavior Distribution

                                                                                              Click to dive into process behavior distribution

                                                                                              Behavior

                                                                                              Click to jump to process

                                                                                              System Behavior

                                                                                              General

                                                                                              Target ID:0
                                                                                              Start time:17:00:46
                                                                                              Start date:02/10/2024
                                                                                              Path:C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exe
                                                                                              Wow64 process (32bit):true
                                                                                              Commandline:"C:\Users\user\Desktop\ScreenConnect.ClientSetup (1).exe"
                                                                                              Imagebase:0x10000
                                                                                              File size:5'621'320 bytes
                                                                                              MD5 hash:2FBF1296C804795CD2F5E0A301307472
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language
                                                                                              Yara matches:
                                                                                              • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000000.00000002.2155563654.0000000005CC0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                              • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000000.00000000.2128643109.0000000000026000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                              Reputation:low
                                                                                              Has exited:true

                                                                                              General

                                                                                              Target ID:2
                                                                                              Start time:17:00:47
                                                                                              Start date:02/10/2024
                                                                                              Path:C:\Windows\SysWOW64\msiexec.exe
                                                                                              Wow64 process (32bit):true
                                                                                              Commandline:"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ScreenConnect\ccf23f1afa8af061\setup.msi"
                                                                                              Imagebase:0x570000
                                                                                              File size:59'904 bytes
                                                                                              MD5 hash:9D09DC1EDA745A5F87553048E57620CF
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language
                                                                                              Reputation:high
                                                                                              Has exited:true

                                                                                              General

                                                                                              Target ID:3
                                                                                              Start time:17:00:47
                                                                                              Start date:02/10/2024
                                                                                              Path:C:\Windows\System32\msiexec.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:C:\Windows\system32\msiexec.exe /V
                                                                                              Imagebase:0x7ff7939b0000
                                                                                              File size:69'632 bytes
                                                                                              MD5 hash:E5DA170027542E25EDE42FC54C929077
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language
                                                                                              Reputation:high
                                                                                              Has exited:false

                                                                                              General

                                                                                              Target ID:4
                                                                                              Start time:17:00:48
                                                                                              Start date:02/10/2024
                                                                                              Path:C:\Windows\SysWOW64\msiexec.exe
                                                                                              Wow64 process (32bit):true
                                                                                              Commandline:C:\Windows\syswow64\MsiExec.exe -Embedding BC108F69163DAA59A6F9981178743870 C
                                                                                              Imagebase:0x570000
                                                                                              File size:59'904 bytes
                                                                                              MD5 hash:9D09DC1EDA745A5F87553048E57620CF
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language
                                                                                              Reputation:high
                                                                                              Has exited:true

                                                                                              General

                                                                                              Target ID:5
                                                                                              Start time:17:00:48
                                                                                              Start date:02/10/2024
                                                                                              Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                              Wow64 process (32bit):true
                                                                                              Commandline:rundll32.exe "C:\Users\user\AppData\Local\Temp\MSICF5E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_7262203 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                                                                                              Imagebase:0xfa0000
                                                                                              File size:61'440 bytes
                                                                                              MD5 hash:889B99C52A60DD49227C5E485A016679
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language
                                                                                              Reputation:high
                                                                                              Has exited:true

                                                                                              General

                                                                                              Target ID:6
                                                                                              Start time:17:00:49
                                                                                              Start date:02/10/2024
                                                                                              Path:C:\Windows\SysWOW64\msiexec.exe
                                                                                              Wow64 process (32bit):true
                                                                                              Commandline:C:\Windows\syswow64\MsiExec.exe -Embedding CCDB78175ACA179D0D189E42F6A15F79
                                                                                              Imagebase:0x570000
                                                                                              File size:59'904 bytes
                                                                                              MD5 hash:9D09DC1EDA745A5F87553048E57620CF
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language
                                                                                              Reputation:high
                                                                                              Has exited:true

                                                                                              General

                                                                                              Target ID:7
                                                                                              Start time:17:00:50
                                                                                              Start date:02/10/2024
                                                                                              Path:C:\Windows\SysWOW64\msiexec.exe
                                                                                              Wow64 process (32bit):true
                                                                                              Commandline:C:\Windows\syswow64\MsiExec.exe -Embedding 644E16E75658CB40C644CEA9BB61A5D0 E Global\MSI0000
                                                                                              Imagebase:0x570000
                                                                                              File size:59'904 bytes
                                                                                              MD5 hash:9D09DC1EDA745A5F87553048E57620CF
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language
                                                                                              Reputation:high
                                                                                              Has exited:true

                                                                                              General

                                                                                              Target ID:8
                                                                                              Start time:17:00:50
                                                                                              Start date:02/10/2024
                                                                                              Path:C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exe
                                                                                              Wow64 process (32bit):true
                                                                                              Commandline:"C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-f13iq7-relay.screenconnect.com&p=443&s=8c4565db-ac67-42c5-9630-9aa3f157ab83&k=BgIAAACkAABSU0ExAAgAAAEAAQC1MY9w4B1kmCI8rrVVcN3Qv2pF2incNEaC5%2f57%2frQys%2fxWV8jitTHxen5sI4Wll36RpM9KV99bb78RmSViUCckbjE5KmpupWzSRQPRoXSxvLn2bqJ43r%2b0c1Xzj6wxUS%2bGCdb3y5osDTbAX4izwcSX%2fWd5MibcXFXyV0GDsYs7uPqQNXSNtw1v5PTrV4hH6KEn7iG8xD119OfXklw0j4quXgapgwpI4dZ5E20CIMcRqfPC5dqnBzSKD%2bnQ0l48Ao%2fzM5ObrNV%2f8giwIObi%2f%2b9H0BQvztiy4rypOySEqrH3oVDeR1OWmdV0FGCTguAa5uyNJoKXRLqK4n1ztMQHr%2f%2bi&c=Van%20Buren%20Telephone%20Company&c=&c=&c=&c=&c=&c=&c="
                                                                                              Imagebase:0x100000
                                                                                              File size:95'520 bytes
                                                                                              MD5 hash:361BCC2CB78C75DD6F583AF81834E447
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language
                                                                                              Antivirus matches:
                                                                                              • Detection: 0%, ReversingLabs
                                                                                              Reputation:moderate
                                                                                              Has exited:false

                                                                                              General

                                                                                              Target ID:9
                                                                                              Start time:17:00:51
                                                                                              Start date:02/10/2024
                                                                                              Path:C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:"C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exe" "RunRole" "45494334-b96f-4a01-b0ee-df000a95fbae" "User"
                                                                                              Imagebase:0x620000
                                                                                              File size:601'376 bytes
                                                                                              MD5 hash:20AB8141D958A58AADE5E78671A719BF
                                                                                              Has elevated privileges:false
                                                                                              Has administrator privileges:false
                                                                                              Programmed in:C, C++ or other language
                                                                                              Yara matches:
                                                                                              • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000009.00000000.2182692087.0000000000622000.00000002.00000001.01000000.00000011.sdmp, Author: Joe Security
                                                                                              • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000009.00000002.3384013467.0000000002821000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                              • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Program Files (x86)\ScreenConnect Client (ccf23f1afa8af061)\ScreenConnect.WindowsClient.exe, Author: Joe Security
                                                                                              Antivirus matches:
                                                                                              • Detection: 0%, ReversingLabs
                                                                                              Reputation:moderate
                                                                                              Has exited:false

                                                                                              General

                                                                                              Target ID:10
                                                                                              Start time:17:00:53
                                                                                              Start date:02/10/2024
                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                              Imagebase:0x7ff7403e0000
                                                                                              File size:55'320 bytes
                                                                                              MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language
                                                                                              Reputation:high
                                                                                              Has exited:false

                                                                                              Disassembly

                                                                                              Reset < >

                                                                                                Executed Functions

                                                                                                Function 05C26F00 Relevance: 1.9, Strings: 1, Instructions: 631COMMON
                                                                                                Download Yara Rule
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID: 0-3916222277
                                                                                                • Opcode ID: d71585daab64bf75e07638a450a8298a485c00a5c43cb2f94be02c85bcc26b13
                                                                                                • Instruction ID: c0b63b5d67f887896f4848c532993e60575515e36e6fa0a6383c97af6c115ce3
                                                                                                • Opcode Fuzzy Hash: d71585daab64bf75e07638a450a8298a485c00a5c43cb2f94be02c85bcc26b13
                                                                                                • Instruction Fuzzy Hash: 37524B34A00228CFEB15DF64C845BADBBB6FF89300F148599E909A7355CBB5AD81CF94
                                                                                                Function 05C26EF1 Relevance: 1.9, Strings: 1, Instructions: 617COMMON
                                                                                                Download Yara Rule
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID: 0-3916222277
                                                                                                • Opcode ID: 8e109dd7dcd9a5b37fd844c7f2fbf2a214e9e051c7dea48e555cf70c1c86d929
                                                                                                • Instruction ID: 2974a4236917df31afa6835d9c2ce1dc35ca415e01e514c007be614e2b84d01c
                                                                                                • Opcode Fuzzy Hash: 8e109dd7dcd9a5b37fd844c7f2fbf2a214e9e051c7dea48e555cf70c1c86d929
                                                                                                • Instruction Fuzzy Hash: 2C423A34A00228CFEB15DF64C845BADBBB6FF89300F148599E909A7355CBB5AD81CF94
                                                                                                Function 05C29F00 Relevance: .7, Instructions: 706COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: dcf0ea25728b365eaa24559482c8ad7cb693beb38836f421f9f97eeb088b7e85
                                                                                                • Instruction ID: 353b4b0ecd9a958136f5c9c1facc3243223991196eea99f307ea898c33c63328
                                                                                                • Opcode Fuzzy Hash: dcf0ea25728b365eaa24559482c8ad7cb693beb38836f421f9f97eeb088b7e85
                                                                                                • Instruction Fuzzy Hash: 48528270A006158FDB18DFA9C884A6EBBF2FF84710F148A2DE515AB751DB74EC41CB94
                                                                                                Function 05C2F0A3 Relevance: .6, Instructions: 642COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 0a339da2b526db9770d554367fb16ac7af2582908c916f932e3492accb72df29
                                                                                                • Instruction ID: e2a6e6b58cf093192f0e5c81c4303b6b00953b6d7f891f826644c71f94de4433
                                                                                                • Opcode Fuzzy Hash: 0a339da2b526db9770d554367fb16ac7af2582908c916f932e3492accb72df29
                                                                                                • Instruction Fuzzy Hash: 38520E34A00228DFDB14DFA5C899B9DB7B2FF88310F148569E959AB365DB70AD81CF40
                                                                                                Function 016E786A Relevance: 2.7, Strings: 2, Instructions: 193COMMON
                                                                                                Download Yara Rule
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: C8${/
                                                                                                • API String ID: 0-4231431693
                                                                                                • Opcode ID: 5891cd058e88d552481e829a8dcd1022161816caca9b7eaf2b2236e317eaba7a
                                                                                                • Instruction ID: e5d75d4b108fabfe370217095976d4e4f78376b32739ea23749b9b985e02ecbf
                                                                                                • Opcode Fuzzy Hash: 5891cd058e88d552481e829a8dcd1022161816caca9b7eaf2b2236e317eaba7a
                                                                                                • Instruction Fuzzy Hash: 82619D30301A068FE716EB6CD99855E7BE3EBC6610314832AD516CF748EFB4AD1587D4
                                                                                                Function 05C226C8 Relevance: 1.4, Strings: 1, Instructions: 173COMMON
                                                                                                Download Yara Rule
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: k1m^
                                                                                                • API String ID: 0-2504568004
                                                                                                • Opcode ID: 86872ba22d644da24c3865df5cf1b9a4f2add7950e4d0b11eed3574e275e6c52
                                                                                                • Instruction ID: c078b8ea6154629c8f92eabd7f52248cd605b006493a53cfcc2c927677dc856f
                                                                                                • Opcode Fuzzy Hash: 86872ba22d644da24c3865df5cf1b9a4f2add7950e4d0b11eed3574e275e6c52
                                                                                                • Instruction Fuzzy Hash: 4D514C78B00305CFCB14DF69C88096ABBF6FF99204B548969E505DB365EB70ED01DB90
                                                                                                Function 05C226D8 Relevance: 1.4, Strings: 1, Instructions: 170COMMON
                                                                                                Download Yara Rule
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: k1m^
                                                                                                • API String ID: 0-2504568004
                                                                                                • Opcode ID: f0011c9052f1122b0acd4866328de61c33d0aa0ed51661bf5feaeb7f40b0f49d
                                                                                                • Instruction ID: 34976882a9ebddc323fd23c5d50b6d8a93288dd41a7b1be165926784d9d4c5b8
                                                                                                • Opcode Fuzzy Hash: f0011c9052f1122b0acd4866328de61c33d0aa0ed51661bf5feaeb7f40b0f49d
                                                                                                • Instruction Fuzzy Hash: C7512B78B00205CFCB14DFA9C88496ABBF6FF99304B548969E505DB365EB70ED01DB90
                                                                                                Function 016E879F Relevance: 1.4, Strings: 1, Instructions: 134COMMON
                                                                                                Download Yara Rule
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: K]
                                                                                                • API String ID: 0-3798347547
                                                                                                • Opcode ID: 67ca1fd6c585b6b79390de16aaaefce4d6094b65af8a01378f96a10efc27ff44
                                                                                                • Instruction ID: 22a1beff68d0b482a85584a09efde905798264fb269b4b7d4d855581d389ba16
                                                                                                • Opcode Fuzzy Hash: 67ca1fd6c585b6b79390de16aaaefce4d6094b65af8a01378f96a10efc27ff44
                                                                                                • Instruction Fuzzy Hash: 8141F2316052408FDB02CB68DC9859EBFF5EF9626074986ABD844CF356DB34DD06C7A1
                                                                                                Function 05C2B751 Relevance: 1.4, Strings: 1, Instructions: 116COMMON
                                                                                                Download Yara Rule
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: s+
                                                                                                • API String ID: 0-1285507049
                                                                                                • Opcode ID: 2391835dad4e220725962904f09635400f59460775173409b98bdd3d02cd1369
                                                                                                • Instruction ID: b4a8aa39a2c4431ca555e5c0be4eb1b2011c2c24e0076f9f151d022118db79ea
                                                                                                • Opcode Fuzzy Hash: 2391835dad4e220725962904f09635400f59460775173409b98bdd3d02cd1369
                                                                                                • Instruction Fuzzy Hash: 2241D271A002259BDB19DFA4D89069EBBB2EF85310F54892DE909EB340DF70AD85CBD4
                                                                                                Function 05C41B23 Relevance: 1.3, Strings: 1, Instructions: 60COMMON
                                                                                                Download Yara Rule
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: s/1m^
                                                                                                • API String ID: 0-1890653327
                                                                                                • Opcode ID: 4e0a2358573ef41ab01767a27743510094740740d6ab2a705a6713c211225f59
                                                                                                • Instruction ID: ff27466b2abfadc8f46e7f59b0311df6c10718af947389d89ad3514f399253eb
                                                                                                • Opcode Fuzzy Hash: 4e0a2358573ef41ab01767a27743510094740740d6ab2a705a6713c211225f59
                                                                                                • Instruction Fuzzy Hash: F711C8B13007059BD704EFA5D8D096EBBB6FBC52503848D2DE5159B300EFB0AD458BE8
                                                                                                Function 05C41B28 Relevance: 1.3, Strings: 1, Instructions: 59COMMON
                                                                                                Download Yara Rule
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: s/1m^
                                                                                                • API String ID: 0-1890653327
                                                                                                • Opcode ID: ea9b327fc0a18f5266789fe55da52b37c230ebdd2a102bb929a1604152373a33
                                                                                                • Instruction ID: 06da742431d47305f39d8d3129f6afa5ad4a7574ddb817e522c2798d840259c5
                                                                                                • Opcode Fuzzy Hash: ea9b327fc0a18f5266789fe55da52b37c230ebdd2a102bb929a1604152373a33
                                                                                                • Instruction Fuzzy Hash: 9D1198B13007159BD704EFA5D8D096EBBB6FBC52503848D2DE5159B310EFB0AD458BE8
                                                                                                Function 05C44DF8 Relevance: .3, Instructions: 336COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: b13cfe9d954d8d3f0e1f5d9871efae194312a31e7c61e95b30f52c7b6428398c
                                                                                                • Instruction ID: 6d744a36f64d6c44a2864ac250e0af4c8b22e5e0f0b2094f42e0483cc4bb9e23
                                                                                                • Opcode Fuzzy Hash: b13cfe9d954d8d3f0e1f5d9871efae194312a31e7c61e95b30f52c7b6428398c
                                                                                                • Instruction Fuzzy Hash: 85E14F79A00615CFCB04DF98C984EAAB7F2FF88310B558959E805AB365EB70ED45CF90
                                                                                                Function 05C2F933 Relevance: .3, Instructions: 298COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 1376ea78cca66599802a2f9db4c363d2a7e2df920d33f455f5501b1079c7cc63
                                                                                                • Instruction ID: de517620479c785554826fea1021ac50ed8dcb9a5db38d1c4577d9af6eec9638
                                                                                                • Opcode Fuzzy Hash: 1376ea78cca66599802a2f9db4c363d2a7e2df920d33f455f5501b1079c7cc63
                                                                                                • Instruction Fuzzy Hash: 32C1E574A002199FD714DFA8C884E6AB7F2FF88310F558559E91AAB3A1D770EC41CB60
                                                                                                Function 05C45AE3 Relevance: .3, Instructions: 294COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 178764f6f6cffc2d454afd981692ed3a51acbc3c471ebb2112b175ddcc284cbe
                                                                                                • Instruction ID: a4dceb9e73cede4079597aad3f145ba3a2e0249dbb1f55fcf7f8310df330db7b
                                                                                                • Opcode Fuzzy Hash: 178764f6f6cffc2d454afd981692ed3a51acbc3c471ebb2112b175ddcc284cbe
                                                                                                • Instruction Fuzzy Hash: 89B18535B002149FDB18EBA8C894A6EBBF3EFC8210F548868D506AB394DF349D41CF95
                                                                                                Function 016EDA79 Relevance: .3, Instructions: 293COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 58e9d8cfc6b5243afae71e48c61c7f75ff3cb928ee099677289e412f73cf92fb
                                                                                                • Instruction ID: 6e8872a87ba1209f79b79e8bc4c44b726f30ca10cf6cc6356ab76bec7451b245
                                                                                                • Opcode Fuzzy Hash: 58e9d8cfc6b5243afae71e48c61c7f75ff3cb928ee099677289e412f73cf92fb
                                                                                                • Instruction Fuzzy Hash: 19C11335A0160ADFCF01CFA8C8849AEBBF6FF49314F248559E915A7361D732E912CB90
                                                                                                Function 05C43B73 Relevance: .3, Instructions: 288COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: c1aa9e3b84ff25ad3a4c09d3cb2172d493c1d41659478156727970de7b884390
                                                                                                • Instruction ID: 26d4823acbee9578f1f02e99fdb7a212e73a7717571e0f93da5663008e58ec5e
                                                                                                • Opcode Fuzzy Hash: c1aa9e3b84ff25ad3a4c09d3cb2172d493c1d41659478156727970de7b884390
                                                                                                • Instruction Fuzzy Hash: C0C13A34601615CFCB04DF58C984DAEBBF2FF84704B968999E5069B2A6DB30FD85CB90
                                                                                                Function 016EFC6A Relevance: .3, Instructions: 278COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: f9045d4c2036569f32f2e41c8c92eeb35bc85344d19826864e4007aee8e6fdac
                                                                                                • Instruction ID: a6c7c6e9d23460b8690eae9ed223ae1fbe6a7635a1065ff67743f2ab95931e38
                                                                                                • Opcode Fuzzy Hash: f9045d4c2036569f32f2e41c8c92eeb35bc85344d19826864e4007aee8e6fdac
                                                                                                • Instruction Fuzzy Hash: 5BB1BB31611601CFD705DF28C898A6ABFF1FF8A720B04569DE95ACB7A1DB71AC01CB90
                                                                                                Function 05C217C0 Relevance: .2, Instructions: 242COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 2cbbdd35996121a5ee630f10061c85db0b1f88e14841de8e66c427331aa3ba7d
                                                                                                • Instruction ID: c83b957fb93b13c8530ac3f1dee2a43c05d7f59bfdfe7b8a97aa667d6084db0c
                                                                                                • Opcode Fuzzy Hash: 2cbbdd35996121a5ee630f10061c85db0b1f88e14841de8e66c427331aa3ba7d
                                                                                                • Instruction Fuzzy Hash: 54A1D774B00215CFDB14DBA8C594AADBBF2FF89700B548969E506AB364DB71AD01CF90
                                                                                                Function 05C2AC28 Relevance: .2, Instructions: 235COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: dc8cc7dc5d750052019757a8dd1a56fbc9aee3985334906322abdf8cbff75abf
                                                                                                • Instruction ID: 2227dcd74fb1eccf42a93e3ac9914ffe334ea41acea393802ced9370b2996cec
                                                                                                • Opcode Fuzzy Hash: dc8cc7dc5d750052019757a8dd1a56fbc9aee3985334906322abdf8cbff75abf
                                                                                                • Instruction Fuzzy Hash: C59156756006169FC724DFA8C880A6EFBF2FF88310B548A29E5469B751DB70FD41CBA0
                                                                                                Function 05C217B1 Relevance: .2, Instructions: 233COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: b510ffe03ec2f0f018742dc77d361dccfdcdbf24ddbf0875cb3986dd40d81138
                                                                                                • Instruction ID: 66e23b8a49262cffacbcd259c01958c0f0cb1d0172865f492084e8ec46af9fa5
                                                                                                • Opcode Fuzzy Hash: b510ffe03ec2f0f018742dc77d361dccfdcdbf24ddbf0875cb3986dd40d81138
                                                                                                • Instruction Fuzzy Hash: A991FA74B00215CFDB14DBA8C594AADBBF2FF89300B5489A9E506AB365DB71ED01CF90
                                                                                                Function 05C2FCAB Relevance: .2, Instructions: 222COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 5e529ed03e2225504dbd84710fa1ebae0480871ef75ad206245cb7d8743e7450
                                                                                                • Instruction ID: 08764a6593474e52505152aa6ffa73a16d26ae7fad014f13a557699381f56987
                                                                                                • Opcode Fuzzy Hash: 5e529ed03e2225504dbd84710fa1ebae0480871ef75ad206245cb7d8743e7450
                                                                                                • Instruction Fuzzy Hash: F4916A71600719EFCB25DF68C880A6EBBB2FF84300F45896DE8469B656D774F941CBA0
                                                                                                Function 016E5D30 Relevance: .2, Instructions: 220COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 064d433b5de872d63a9bce9a221432a73c7114d3f1752d49bf5c017d2fe26b47
                                                                                                • Instruction ID: b1a2b44253d87af9de4a6529158a6fc2de8a051b276419a27af4685d386f91a4
                                                                                                • Opcode Fuzzy Hash: 064d433b5de872d63a9bce9a221432a73c7114d3f1752d49bf5c017d2fe26b47
                                                                                                • Instruction Fuzzy Hash: F7916938A007158FDB65DF68D95859EBBF2EF85314B14822AD806EF359DB70AC06CF90
                                                                                                Function 016E41E0 Relevance: .2, Instructions: 218COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 272df14230215c8def83e81ebef9e468a1375b96722547182333f53a1697a560
                                                                                                • Instruction ID: caf8a307cae46eae3fa9ffba5c052205ed250d8cb6773262e5cacc616269307c
                                                                                                • Opcode Fuzzy Hash: 272df14230215c8def83e81ebef9e468a1375b96722547182333f53a1697a560
                                                                                                • Instruction Fuzzy Hash: 88911874B002069FDB55DF69D898A6EBBF2FB88300B148629E916DB355DF74EC02CB50
                                                                                                Function 016E41F0 Relevance: .2, Instructions: 215COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 9ec55db2c3eb498c0fa63362bf3949550b2e2bdbb00ab94d5cefdefbfe26d8ac
                                                                                                • Instruction ID: 7e24c5968d6a67a9a672d84a06c1fcfb9a3fbfb38b4361185b083da802cc91ae
                                                                                                • Opcode Fuzzy Hash: 9ec55db2c3eb498c0fa63362bf3949550b2e2bdbb00ab94d5cefdefbfe26d8ac
                                                                                                • Instruction Fuzzy Hash: 7C812934B002069FDB55DF69D898A6EBBF2FB88700B148629E916DB354DF74EC02CB50
                                                                                                Function 05C2D120 Relevance: .2, Instructions: 207COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: ca0d985eb2c28176b9fd7bbcfeaa836dd0b59ecb18ecc6828f9ef68ff70f4ddb
                                                                                                • Instruction ID: 3d4cf06ca72cc9dd29be7ec3a1c06df0f8d518bd8e52d222c2d83d0f7dc8d3e9
                                                                                                • Opcode Fuzzy Hash: ca0d985eb2c28176b9fd7bbcfeaa836dd0b59ecb18ecc6828f9ef68ff70f4ddb
                                                                                                • Instruction Fuzzy Hash: C0815B74B002159FDB14DF68C994EAEBBF6FF88710F158559E905AB3A1DB30AD01CB60
                                                                                                Function 05C28FF8 Relevance: .2, Instructions: 201COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 53a959913df17d53baeecf0b3bcc54f9f229c8f95b63217fb7b79ae6c74694d1
                                                                                                • Instruction ID: 6dbff92cdd1865b9f801ce84e1f59c598f3c85ca42afb8b2c088ba9be0314a04
                                                                                                • Opcode Fuzzy Hash: 53a959913df17d53baeecf0b3bcc54f9f229c8f95b63217fb7b79ae6c74694d1
                                                                                                • Instruction Fuzzy Hash: 4C71CD31A002159FDB18DBA8D894B9CBBF2FF88710F548569E405EB390DF71AD86CB90
                                                                                                Function 016E6CB8 Relevance: .2, Instructions: 199COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 39cf41bf75d0aaf843f737b432aa85e2b7783e62ad461445517a6b03b1f2a500
                                                                                                • Instruction ID: b49d9e0097075c6ef0e49ec18a18e95931e7f16f68d19bde5fbf218c121c99b6
                                                                                                • Opcode Fuzzy Hash: 39cf41bf75d0aaf843f737b432aa85e2b7783e62ad461445517a6b03b1f2a500
                                                                                                • Instruction Fuzzy Hash: A2617132B016098FCB19DF68D8444AEBBF2FFD9210718866ED50AEB395DB71AC05CB50
                                                                                                Function 05C2D111 Relevance: .2, Instructions: 193COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 61c40035b0a0f55dc9b714ef380e16125542dbd6ac951846f61215317a2dece4
                                                                                                • Instruction ID: 09575c67e76af1a4ac19dd3222ce7e2e264a953bb32e97a3835b5df312b3ed17
                                                                                                • Opcode Fuzzy Hash: 61c40035b0a0f55dc9b714ef380e16125542dbd6ac951846f61215317a2dece4
                                                                                                • Instruction Fuzzy Hash: 80716C74B002159FDB14DFA8C984E6EB7F6FF88710F158559E905AB3A5CB30AD01CBA0
                                                                                                Function 016E88D8 Relevance: .2, Instructions: 192COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: a8486537f93940e4f1b2c39b85f0f91efaddbb389028d653aa2bdda16f7c64a6
                                                                                                • Instruction ID: 8f93b97f0fb994e81a51ba9a5c4f922baa1297e6dcc909224d6121936614973c
                                                                                                • Opcode Fuzzy Hash: a8486537f93940e4f1b2c39b85f0f91efaddbb389028d653aa2bdda16f7c64a6
                                                                                                • Instruction Fuzzy Hash: 6C61F534B116099FDB14DF69D8989AABBF6FF89305B108169E506AB365DB30EC02DB40
                                                                                                Function 05C23A58 Relevance: .2, Instructions: 180COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 6ac5e160c01b0c7715e0f98a0c0a0f6aefd7aea4f4db8df8a375127d3f0f5083
                                                                                                • Instruction ID: 22ef37208d8e9402dff87b4b7862d7ac69a49429b0482729dbd2bbeae29ca176
                                                                                                • Opcode Fuzzy Hash: 6ac5e160c01b0c7715e0f98a0c0a0f6aefd7aea4f4db8df8a375127d3f0f5083
                                                                                                • Instruction Fuzzy Hash: D451CD30B002619FDB249B65D858B7EBBF6BF84B10F148E29E416DB295DB789C41CB90
                                                                                                Function 05C2EC40 Relevance: .2, Instructions: 169COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 26daa9399b959cdfa4cab7f8e36c3c81d51f2d233add86b1cb69a8e419cd2bc2
                                                                                                • Instruction ID: 01ca3f41f57c05706be7b8c16bae4d9fb45045779f0763d336e669d0eff38613
                                                                                                • Opcode Fuzzy Hash: 26daa9399b959cdfa4cab7f8e36c3c81d51f2d233add86b1cb69a8e419cd2bc2
                                                                                                • Instruction Fuzzy Hash: 8251D731F002298BDB28DBB5885057EBBBBBFC8720B24482BC555AB345DF359942C7E1
                                                                                                Function 05C2EEC0 Relevance: .2, Instructions: 167COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: b8caf8399c43169b57ce1eec8490a04fd8f687cb408dcc18dd99fd8d07f67562
                                                                                                • Instruction ID: 7072c3851e524ec3ccdfb398e06f7b13554842d55e565a59b8206f22e9c1b03f
                                                                                                • Opcode Fuzzy Hash: b8caf8399c43169b57ce1eec8490a04fd8f687cb408dcc18dd99fd8d07f67562
                                                                                                • Instruction Fuzzy Hash: 75517375B001299FDB18DFA9C894AAEB7F2FFC8310F148568E916A7360DB319D51CB90
                                                                                                Function 05C4129B Relevance: .2, Instructions: 164COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 5493d7f6c4c4b876516785e6e3b8d38ce0a31411f82fa6c9dee0d5b1960099b0
                                                                                                • Instruction ID: 6e40234583b678c98adc56ae22fa442c3838ccbb5d207c41bb007d8482e2646e
                                                                                                • Opcode Fuzzy Hash: 5493d7f6c4c4b876516785e6e3b8d38ce0a31411f82fa6c9dee0d5b1960099b0
                                                                                                • Instruction Fuzzy Hash: 97514A31A002199BCB10DF99C984AAEBBF6FF88310F199525E859E7350D734ED81CB90
                                                                                                Function 016EFDA8 Relevance: .2, Instructions: 162COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: d1874e25b9248e661b6ce7c491ae8952fbfc36da18c9682d9e87a3c94974b38b
                                                                                                • Instruction ID: a4752dd86ff2bc094f691993da912dd2ae3d9d15d3fe1817111320d79c28c5bd
                                                                                                • Opcode Fuzzy Hash: d1874e25b9248e661b6ce7c491ae8952fbfc36da18c9682d9e87a3c94974b38b
                                                                                                • Instruction Fuzzy Hash: 2D61FF34710A01CFC754DF69C88895ABBF6FF896107109AA9E91AEB761DB70EC01CF90
                                                                                                Function 016EFDB8 Relevance: .2, Instructions: 156COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 97a56ae0d7a3b9f6672030478a432f7049e9dc0ee09d9077dc9a46b51f594b2f
                                                                                                • Instruction ID: 24182dba8bbf88e7ed5cf42ec047f55f0c0889629a3d20e57f1f706d93a4d40f
                                                                                                • Opcode Fuzzy Hash: 97a56ae0d7a3b9f6672030478a432f7049e9dc0ee09d9077dc9a46b51f594b2f
                                                                                                • Instruction Fuzzy Hash: A061DD34610A01CFC754DF69C88896ABBF6FF8961075199A9E91AEB721DB70EC01CF90
                                                                                                Function 016E6307 Relevance: .2, Instructions: 155COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 16abd6757cf13e8d8ae944ce83845098c33ea07d779d1e9d6276f02a3a65440f
                                                                                                • Instruction ID: 5a4bd9db61ad840ddebf33035cc3fec6b3dce0317ce36ca3fcf8f18f2b9f9fce
                                                                                                • Opcode Fuzzy Hash: 16abd6757cf13e8d8ae944ce83845098c33ea07d779d1e9d6276f02a3a65440f
                                                                                                • Instruction Fuzzy Hash: F5513B35A10619CFCB45CFA9C88499DBBF6FF8A700B25816AE505EF321DBB1AD05CB40
                                                                                                Function 016ED350 Relevance: .2, Instructions: 152COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 2ae7bc449f52de6f1a0e6b53e2a8eb1a464b866ca4fae96c3ef984048d9736ba
                                                                                                • Instruction ID: de2a2f92faffc0898664e71b19b29437cd023659fa24f41ef3d1a82886455381
                                                                                                • Opcode Fuzzy Hash: 2ae7bc449f52de6f1a0e6b53e2a8eb1a464b866ca4fae96c3ef984048d9736ba
                                                                                                • Instruction Fuzzy Hash: 1151E134B052058BDB04DFA9C8986AEBBE2FBC5210F14466AE905CB384DF349C04C7A1
                                                                                                Function 05C290B0 Relevance: .1, Instructions: 146COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: beb0f11f20fb281a836c75b503bc7696b8eba2f8f830577271f9985c5ce1ffd1
                                                                                                • Instruction ID: 19a95e75cb6f82ed8b77e27edee40a134a94d090a9a043ac3b62a4edb8f3d809
                                                                                                • Opcode Fuzzy Hash: beb0f11f20fb281a836c75b503bc7696b8eba2f8f830577271f9985c5ce1ffd1
                                                                                                • Instruction Fuzzy Hash: B1517C70A00219DFDB08DFA9D588B9CFBF2FF88310F148668E405A7260DB71AD85CB90
                                                                                                Function 05C2B9F8 Relevance: .1, Instructions: 145COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 5255ed6a4816ce65a7718b48b21efc70b63c10176fa2532e233534a1e223dffd
                                                                                                • Instruction ID: 509cd653578929f718f8965989e89537ef2cfef14a5c2968f5d1fe930d9b0efe
                                                                                                • Opcode Fuzzy Hash: 5255ed6a4816ce65a7718b48b21efc70b63c10176fa2532e233534a1e223dffd
                                                                                                • Instruction Fuzzy Hash: ED515C34A002159FC714DFA8D8C4E6EBBB2FB88314B558866E549DB365EB71EC41CBA0
                                                                                                Function 05C40128 Relevance: .1, Instructions: 139COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 27e31369e33d24bf6f985206beeea8c2d35740825d6781a774c37444aa35392f
                                                                                                • Instruction ID: b84dbddc45f39cf6ec121e6c0c6cf69220d6923f4bb6d2766c06ca3e789aadf4
                                                                                                • Opcode Fuzzy Hash: 27e31369e33d24bf6f985206beeea8c2d35740825d6781a774c37444aa35392f
                                                                                                • Instruction Fuzzy Hash: 27517C747002059FDB08DF68C885E6EB7B6EF84314F558599EA05AF3A1DB71EC42CB90
                                                                                                Function 016E6040 Relevance: .1, Instructions: 137COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 16b1ba032953ec1d64f05eb3e0d1058569a70a8114939634ca22cb5902f17556
                                                                                                • Instruction ID: 3acd4f9b609f2253c89d0959d3cc0413b5eed018fd3d8c5a1a14ed29b4d31ab8
                                                                                                • Opcode Fuzzy Hash: 16b1ba032953ec1d64f05eb3e0d1058569a70a8114939634ca22cb5902f17556
                                                                                                • Instruction Fuzzy Hash: BB518C30E00309DFDB00DFB8D844B9DBBB2FF89300F149669E504AB291DBB9A945CB90
                                                                                                Function 016E8BE8 Relevance: .1, Instructions: 136COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 57b10046f6507d42f35cdd57cf6dfd640c0c55ae19f4d2f20f1ee7a780718e7f
                                                                                                • Instruction ID: a832f7111542b1af11ba434918dc973c205e10aec9f1b5fd67e0bd9ac08b2f5c
                                                                                                • Opcode Fuzzy Hash: 57b10046f6507d42f35cdd57cf6dfd640c0c55ae19f4d2f20f1ee7a780718e7f
                                                                                                • Instruction Fuzzy Hash: E6514030700601CFDB18CF29D898A667BF5EF8A711B0056A9D915DF3A9DB31E822CF91
                                                                                                Function 05C4011B Relevance: .1, Instructions: 134COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 2dd9cb569dfa09ff4f58f88c638d6c72046208cc4207f9838435ea0db594389e
                                                                                                • Instruction ID: d2ed1a4047cd578bcda0ba6acb24589395fce79213d083579eda23d16806bd0e
                                                                                                • Opcode Fuzzy Hash: 2dd9cb569dfa09ff4f58f88c638d6c72046208cc4207f9838435ea0db594389e
                                                                                                • Instruction Fuzzy Hash: 66518A747002059FDB04DF98C885E6EB7B6EF84314F5584A9EA05AF3A1DB71EC42CB90
                                                                                                Function 016E6031 Relevance: .1, Instructions: 131COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: f92b31f6d6fd5a5a11a6d951260f35e2e80b3f3b74dd51a04e82b8d0de603a82
                                                                                                • Instruction ID: e6ae130f08e2e15755b593826d5bb73f6ef0dac96f13b4ac9b1917e3e637d2a3
                                                                                                • Opcode Fuzzy Hash: f92b31f6d6fd5a5a11a6d951260f35e2e80b3f3b74dd51a04e82b8d0de603a82
                                                                                                • Instruction Fuzzy Hash: 4E514930E002099FEB10DFA8D844B9DBBB2FF98300F149669E505AB295DBB5A945CB90
                                                                                                Function 05C29EFB Relevance: .1, Instructions: 130COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: d2913b085e2ac8ff65180d8e9673a043bb387eadb8c1f15d86fe381a729f5942
                                                                                                • Instruction ID: 8c36823d072bb3cf69001d19629b4e48b588aa34e8d5cef4d320b78c5cdbfe8e
                                                                                                • Opcode Fuzzy Hash: d2913b085e2ac8ff65180d8e9673a043bb387eadb8c1f15d86fe381a729f5942
                                                                                                • Instruction Fuzzy Hash: 75417374A002158FDB14DFA8D8849AEFBF2FF88610B14856DE915EB351DB71EC41CBA0
                                                                                                Function 05C413F0 Relevance: .1, Instructions: 130COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 8b1d52f912b9d5e26d2ac228136f87d0471211c398bd2c90bc61eebef564a40d
                                                                                                • Instruction ID: 6eaa4c65993158a197dd1143d6116f65d7de90d1246e9b1dfc42a1b2e1d065cc
                                                                                                • Opcode Fuzzy Hash: 8b1d52f912b9d5e26d2ac228136f87d0471211c398bd2c90bc61eebef564a40d
                                                                                                • Instruction Fuzzy Hash: 7341F4327042049BEB14AF69C444BAE7796FFC07A0F188529E94ACB384CF34DD46CBA1
                                                                                                Function 05C47388 Relevance: .1, Instructions: 128COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: f3c66295a856f26df945fbd822d734f2440131fe7b002a18e86fb922d539156e
                                                                                                • Instruction ID: 89d9d495744531699c6a04687e341cc5f472c9d746aac83c9a42b3401c68ea48
                                                                                                • Opcode Fuzzy Hash: f3c66295a856f26df945fbd822d734f2440131fe7b002a18e86fb922d539156e
                                                                                                • Instruction Fuzzy Hash: 17414134B002159FDB54DFB9C894AAEBBF2FF88610F548568D506AB390DB31AD42CF94
                                                                                                Function 05C2E138 Relevance: .1, Instructions: 126COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 9a78ed2b00f48840d825b10dbee2a42cfd747134ce5678d4765e2084e2e5bbe7
                                                                                                • Instruction ID: f62f6e4e852779a8c94de3449810d49b8f97da1d59677d829971894739b38d33
                                                                                                • Opcode Fuzzy Hash: 9a78ed2b00f48840d825b10dbee2a42cfd747134ce5678d4765e2084e2e5bbe7
                                                                                                • Instruction Fuzzy Hash: DB412D75A00B118FD720CF69D584A6AFBF6FB88320B149A1AD99B97B40D730F941CF90
                                                                                                Function 05C2484B Relevance: .1, Instructions: 123COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 135bc4837f4cd573a489dfb80ffdfe5bbc54d05b64a9701302b2421ebd5b41dc
                                                                                                • Instruction ID: b7a41eb5b7421244b5f0adbc29e843c843e68406d7ae9e1cff826ff7ad3c6e38
                                                                                                • Opcode Fuzzy Hash: 135bc4837f4cd573a489dfb80ffdfe5bbc54d05b64a9701302b2421ebd5b41dc
                                                                                                • Instruction Fuzzy Hash: 40512875A10215DFCB04DFA8E895C99BB71FF8A3007048695F9466B325DBB0EC81DF94
                                                                                                Function 05C298FB Relevance: .1, Instructions: 120COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 5f45a960457136939c9761d1cd66bcda96f407a7d045559a200ae4bfe5624474
                                                                                                • Instruction ID: c643926619d0c9072dfbd5217f0a54b83a732b1c174aa7d3e0b5fc9df9828022
                                                                                                • Opcode Fuzzy Hash: 5f45a960457136939c9761d1cd66bcda96f407a7d045559a200ae4bfe5624474
                                                                                                • Instruction Fuzzy Hash: D7415175B002258FD704DFA8C884B6EB7F2FB88360F158595E959AB3A1DB30DC41CB51
                                                                                                Function 016ED8F8 Relevance: .1, Instructions: 116COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: d744cc08a80cbe8e17ada1c13a4dc1410b45d0fec6859663ae9069c198218610
                                                                                                • Instruction ID: b6c0058a9275d170f99c0a9b5b1a8e916ce63091cc73adf5ee3a6d419c047b0a
                                                                                                • Opcode Fuzzy Hash: d744cc08a80cbe8e17ada1c13a4dc1410b45d0fec6859663ae9069c198218610
                                                                                                • Instruction Fuzzy Hash: 44412678B01205DF9B04DB9DC888EAA7BF6FF8D200B648155EA09DB355DB30ED02DB91
                                                                                                Function 016E4C50 Relevance: .1, Instructions: 110COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 69565d0e4c0a45c3600363edf40fd3e6883971829418c03e8a014fea49753bd6
                                                                                                • Instruction ID: 269ae20cf0a2baba945e0859c8ad027f730ea396f81145eb8758db738f062784
                                                                                                • Opcode Fuzzy Hash: 69565d0e4c0a45c3600363edf40fd3e6883971829418c03e8a014fea49753bd6
                                                                                                • Instruction Fuzzy Hash: A8319C31B002098FEB14DF69C898AAEBBF6EF89654F10856ED506EB750DF71DC018B94
                                                                                                Function 05C28598 Relevance: .1, Instructions: 109COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 18ee60513237c70ab18ea290fc79a2ae4a95d4e3f2b3537316998018135d45a8
                                                                                                • Instruction ID: 7ec4b35ac85a932ec50b7c48df1365bd7afbed4d3150807532c6e91cdabc469e
                                                                                                • Opcode Fuzzy Hash: 18ee60513237c70ab18ea290fc79a2ae4a95d4e3f2b3537316998018135d45a8
                                                                                                • Instruction Fuzzy Hash: EA416930B10216CFDB48DFB8D885A6EBBB6FF89300B508668D505DB361DB74AC05CB90
                                                                                                Function 05C233D0 Relevance: .1, Instructions: 108COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: c76a9adefeaaa0d205e7cac5af4d858c9fccc26f883635fa0b028cdf9bab1450
                                                                                                • Instruction ID: d0b5490ef790368437f874a70e665503840dfce39928b408a7a2848f991347ea
                                                                                                • Opcode Fuzzy Hash: c76a9adefeaaa0d205e7cac5af4d858c9fccc26f883635fa0b028cdf9bab1450
                                                                                                • Instruction Fuzzy Hash: 6E418430B01259ABEB18DBA9D854BADBAB7FFC8700F20492DE505A73D4CF759D018B94
                                                                                                Function 05C24E28 Relevance: .1, Instructions: 108COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 3609de52e5ff7548ec4fe0ce466acea3b7ecc77b93eccddd86a12220d909f018
                                                                                                • Instruction ID: fda4ed57939b4eb072dcdc6ee622b15d538d448de7ecf665ded948d9170ed387
                                                                                                • Opcode Fuzzy Hash: 3609de52e5ff7548ec4fe0ce466acea3b7ecc77b93eccddd86a12220d909f018
                                                                                                • Instruction Fuzzy Hash: 5D41B531A107098FCB05EFB8C8449AEBFB5FF86210F01866AE546AB220EF309554CBD1
                                                                                                Function 05C43620 Relevance: .1, Instructions: 108COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: b46a1b35e542221189a2608673b8c7ae904e244609d83e10ff876d41c8f5a0a7
                                                                                                • Instruction ID: 7aea0be448c7e2a56079cbef35430740c1858d3f599a2e1f9c1aa78845acb32c
                                                                                                • Opcode Fuzzy Hash: b46a1b35e542221189a2608673b8c7ae904e244609d83e10ff876d41c8f5a0a7
                                                                                                • Instruction Fuzzy Hash: 7D3137303043941FDB09AB799858A1EBBE7EFC6650364486DD50ACB391CE31DC07CBA5
                                                                                                Function 05C200F8 Relevance: .1, Instructions: 106COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 9b8cbf4e94ce5397447cf78ba723a62c90701bc3c4d472aa5f309b3aaf437983
                                                                                                • Instruction ID: fa7f8d7ce39c610da5163291519d826903d47741e4fab0b485a89b62be1694ff
                                                                                                • Opcode Fuzzy Hash: 9b8cbf4e94ce5397447cf78ba723a62c90701bc3c4d472aa5f309b3aaf437983
                                                                                                • Instruction Fuzzy Hash: 96315274B102158FCF18DB69C8949AEF7F6FF89210B50892AD509E7344DB74ED01CBA0
                                                                                                Function 05C27C70 Relevance: .1, Instructions: 105COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 6b7104df2cf5421bb676275cc9898fca8a90526650fc9cf1d6c4c6cc4fe79b05
                                                                                                • Instruction ID: 078810b16077e6e435ba6a75f5f890f83ae696e4466c155d3c4e476695f5852e
                                                                                                • Opcode Fuzzy Hash: 6b7104df2cf5421bb676275cc9898fca8a90526650fc9cf1d6c4c6cc4fe79b05
                                                                                                • Instruction Fuzzy Hash: B431E231B003199FCB15DBB5D8945AEFBB6EFC9210B148569E549A7341DB34AC41C7A0
                                                                                                Function 05C2CF3B Relevance: .1, Instructions: 105COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 265e6b9749bd2c33967811a5c145e9169671d8140917684c6ad70cb8c1c9290f
                                                                                                • Instruction ID: 2ccdf9d7b9ba46f97d2a6a605370928501dd889a7e2f53d4be882f5b56b0eb77
                                                                                                • Opcode Fuzzy Hash: 265e6b9749bd2c33967811a5c145e9169671d8140917684c6ad70cb8c1c9290f
                                                                                                • Instruction Fuzzy Hash: 3F315C747002149FDB05DB68CC94B7EBBF3EB88710F149429E906DB3A5DA359C42DB51
                                                                                                Function 05C2CF43 Relevance: .1, Instructions: 104COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 46feb8737af57ebee8bce9e95eec705300e5c46adfae26fbaca8107679f2bab8
                                                                                                • Instruction ID: 6a20007ba0f5a9b47cacb17d11ff1fb4ccc1bfa76af2537f12e72b5e665c5ea9
                                                                                                • Opcode Fuzzy Hash: 46feb8737af57ebee8bce9e95eec705300e5c46adfae26fbaca8107679f2bab8
                                                                                                • Instruction Fuzzy Hash: E331E275B002519FDB15DB78CC94B7E7BF2EB88710F1848A9E906DB392DA319C42CB91
                                                                                                Function 016E44CB Relevance: .1, Instructions: 103COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: e62b41bbc2446055518a8a243665b3b84cf02a2cf97ffd80726b92885ce622e1
                                                                                                • Instruction ID: 9e914f7d8625b702175550a8540528b231e500b1a8f7e55675e52d1c0d98ceef
                                                                                                • Opcode Fuzzy Hash: e62b41bbc2446055518a8a243665b3b84cf02a2cf97ffd80726b92885ce622e1
                                                                                                • Instruction Fuzzy Hash: E9419C34A01219CFEB14DB68D898B6DBBF2FF48300F148518E506AB3A5CFB49C46CB90
                                                                                                Function 016EDCD0 Relevance: .1, Instructions: 101COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 84abd1652c7056c620490929e643dfd0cce9d61693d820f64e8c4b97986fe3d1
                                                                                                • Instruction ID: e45e710bd132b123471e61e4b4c1651d2c96cd2ead274ee28a481d505172534e
                                                                                                • Opcode Fuzzy Hash: 84abd1652c7056c620490929e643dfd0cce9d61693d820f64e8c4b97986fe3d1
                                                                                                • Instruction Fuzzy Hash: 90413D35600609DFCB01CF58C890DAABBF6FF4A324B24C59DE9599B361D732E916CB90
                                                                                                Function 05C23A48 Relevance: .1, Instructions: 101COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: b5057216e5e5d39ab08d86cba82f54f495bb3bf0649b42248183051acab84ace
                                                                                                • Instruction ID: ac9b0bf21abb2a5ebd7a607b7bea646ea7ba879c20993639e801d948ade934cb
                                                                                                • Opcode Fuzzy Hash: b5057216e5e5d39ab08d86cba82f54f495bb3bf0649b42248183051acab84ace
                                                                                                • Instruction Fuzzy Hash: A831CC35B01261CFD720DF64D948B6EB7E2FB80B10F148E6AD45ACB295CB749D88CB90
                                                                                                Function 016E0A10 Relevance: .1, Instructions: 100COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 449ab77ae072c0f068be73f0ebf4ba8a903c7674f788ab6812d6b045399b0fae
                                                                                                • Instruction ID: efb16d09e14bd98f4e6a578625bf506f6a6e29fa1c2aba4440d0dc7172b4ef6d
                                                                                                • Opcode Fuzzy Hash: 449ab77ae072c0f068be73f0ebf4ba8a903c7674f788ab6812d6b045399b0fae
                                                                                                • Instruction Fuzzy Hash: 58419D74E012199FDB58DFAAD984AEEBBF2BF88300F14812AE814A7354DB745942CF50
                                                                                                Function 05C2BD00 Relevance: .1, Instructions: 97COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: d92da86a0fd44a61d0c01c5560b681dd79a8c7dd6bade8be2b6c6d8e061fd813
                                                                                                • Instruction ID: c5d32394e615cdbd24f4a7b8e3b78d3017f47c60622da55830bb0fc7847096fa
                                                                                                • Opcode Fuzzy Hash: d92da86a0fd44a61d0c01c5560b681dd79a8c7dd6bade8be2b6c6d8e061fd813
                                                                                                • Instruction Fuzzy Hash: 86314F74B002168FCB14DFA8C48466EFBB2FB88301B548569E446E7345DB34ED42CBD1
                                                                                                Function 05C41190 Relevance: .1, Instructions: 97COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 0775d7e8b95bd161f717f9f6889414bf2264ca060ac2ff6d2b774108701072a6
                                                                                                • Instruction ID: 56886951fb5b2092670f6d162ab2bbf761aad34d7d96cefbe4ad0c47817e9533
                                                                                                • Opcode Fuzzy Hash: 0775d7e8b95bd161f717f9f6889414bf2264ca060ac2ff6d2b774108701072a6
                                                                                                • Instruction Fuzzy Hash: E341E275E002199FCB04DFA9C984DEEBBF6FF88310B19846AE515F7251DB30A941CBA0
                                                                                                Function 016EA5B9 Relevance: .1, Instructions: 94COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 3acc2db38739dc61f93c943dce30ab08b6db6596cb8bab48ff034b16c5f7edc3
                                                                                                • Instruction ID: 47321d4db047b21cd038f9ddf2996a0aa0941966d8b2ce2594afc720688e5a59
                                                                                                • Opcode Fuzzy Hash: 3acc2db38739dc61f93c943dce30ab08b6db6596cb8bab48ff034b16c5f7edc3
                                                                                                • Instruction Fuzzy Hash: 3F313E35A00518DFDB45DFA8D994999BBB1FF89314B148169EA19AB361C732EC02CF50
                                                                                                Function 05C2BCFB Relevance: .1, Instructions: 93COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: abdc2aa3778c24f0e3e8b636c627d7079b4b4ab7087b4363c123a490afc330fa
                                                                                                • Instruction ID: 79a64e8fe8d8b2fb61553742114367a945a1b67c97ca9b7d67990a635b28b858
                                                                                                • Opcode Fuzzy Hash: abdc2aa3778c24f0e3e8b636c627d7079b4b4ab7087b4363c123a490afc330fa
                                                                                                • Instruction Fuzzy Hash: 29310C74B002168BCB14DFA8D88866EFBB2FB88311B548569E446E7345DB35ED42CBD1
                                                                                                Function 05C4118B Relevance: .1, Instructions: 92COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: d8eeeaa07eb928053d57b19615c379f18b8ea881480dee38b43c37325daf0fe4
                                                                                                • Instruction ID: 3d9c0706837f40a16f42d3a13f13bca9c366fe0ccb1fffe83154d922c301eec7
                                                                                                • Opcode Fuzzy Hash: d8eeeaa07eb928053d57b19615c379f18b8ea881480dee38b43c37325daf0fe4
                                                                                                • Instruction Fuzzy Hash: D731A075E002199FCB14DFA9C984DEEBBF6FB88310B158529E515F7250DB30A941CFA4
                                                                                                Function 016E7180 Relevance: .1, Instructions: 90COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 68cba7a2f912bdccb434313c46c2cc2d5d30515297c30e18c732f384f1b804b4
                                                                                                • Instruction ID: ea1adcb880fa12e7e72cc1614ec0e8a04a9d61ae0a4c07b470d23c1148e3de26
                                                                                                • Opcode Fuzzy Hash: 68cba7a2f912bdccb434313c46c2cc2d5d30515297c30e18c732f384f1b804b4
                                                                                                • Instruction Fuzzy Hash: 9D313D70601B018FD734DF69DC8865ABBF2FB88320B148B2CD566877A0D770A949CBD1
                                                                                                Function 05C2396B Relevance: .1, Instructions: 89COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 06f3ae2a666bba73a583662e3924af26b4bbe280eb4d40f39d303ab10bca03fb
                                                                                                • Instruction ID: e0c50a25d1c1b7c6690bf739a0c13b1ceabd8db387d16c8eefdc461e78771ba6
                                                                                                • Opcode Fuzzy Hash: 06f3ae2a666bba73a583662e3924af26b4bbe280eb4d40f39d303ab10bca03fb
                                                                                                • Instruction Fuzzy Hash: 6821F9729183D48FD706AFB89C643D93F20DF53260F05069BC441C72E2EA754909CBA5
                                                                                                Function 016E6C7F Relevance: .1, Instructions: 87COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: e69a6e223835bd9459bcfd862c4eabe05b79cea45400ef1a76568aef64140e0a
                                                                                                • Instruction ID: 85b2c2741eeadf604d41a7affe3acc09079410d62f9e7356e432ba8d7fe438f7
                                                                                                • Opcode Fuzzy Hash: e69a6e223835bd9459bcfd862c4eabe05b79cea45400ef1a76568aef64140e0a
                                                                                                • Instruction Fuzzy Hash: B521E1317006058FCB16DB28C89459ABFF3EFD521071886AED805EF396DF35AC058B91
                                                                                                Function 016E8F80 Relevance: .1, Instructions: 87COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 3f2918bf5684d659e5a546ec91e12e29c84b20b30952ba713ae27466d14a74a9
                                                                                                • Instruction ID: 7c571f488db440c3d8aa3d3a27c8f8a8f0e2acbd933465c7b1e50ad9480441d3
                                                                                                • Opcode Fuzzy Hash: 3f2918bf5684d659e5a546ec91e12e29c84b20b30952ba713ae27466d14a74a9
                                                                                                • Instruction Fuzzy Hash: CE3116306007018FD734CF2EC84866ABBF2AF89354B548A2DD596DB7A1DB31E946CF80
                                                                                                Function 05C212F9 Relevance: .1, Instructions: 87COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: e8516ae79abbe7cb2a8cc67604f9cd85c970a9a5cb8e206134668e67039648df
                                                                                                • Instruction ID: 7a2fc6b4fee1adbd699133b5954a1e9397b320cb67dbe2a6151ea83916502352
                                                                                                • Opcode Fuzzy Hash: e8516ae79abbe7cb2a8cc67604f9cd85c970a9a5cb8e206134668e67039648df
                                                                                                • Instruction Fuzzy Hash: CA318D31A04258CFDB14DBA8D854BAE7FB2BB8A310F045469E505EB7A1CF745C04CBA5
                                                                                                Function 05C21D48 Relevance: .1, Instructions: 87COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: bc4b224f539d2f145b291608c5738cb1a3efb673cb41ad823483da437e5f12f3
                                                                                                • Instruction ID: 20815462c6eadbd2f85d2d67b267dc996f86cab9693f4b774885a2f41da67ad6
                                                                                                • Opcode Fuzzy Hash: bc4b224f539d2f145b291608c5738cb1a3efb673cb41ad823483da437e5f12f3
                                                                                                • Instruction Fuzzy Hash: CF31E774600B15CFC730DF2AC848A6ABBF5FF49320B145A2CD0969B6A1D770E94ACF84
                                                                                                Function 05C21D3B Relevance: .1, Instructions: 87COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 042b0a6d8fd0f14847a58961e6cf6efe894bf5a053c5e44a235536044c3b4c49
                                                                                                • Instruction ID: 115ce0cd793829f05fa3474937d98bda2dddddbd5cd9f910e262dd61ea25c8b0
                                                                                                • Opcode Fuzzy Hash: 042b0a6d8fd0f14847a58961e6cf6efe894bf5a053c5e44a235536044c3b4c49
                                                                                                • Instruction Fuzzy Hash: E331D874600B15CFC730DF2AD84866ABBF1EF45320F145A2CD1969B6A5D774E94ACF80
                                                                                                Function 016E6FA8 Relevance: .1, Instructions: 85COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: cbe55ff6d959e4d3dd3ba5fc265a7d739a75699713a5186b10576ef4775a140b
                                                                                                • Instruction ID: 303a08749a9a27fc282191b79f93cbdaa9e8f5a5fdd183a85763d269d8bef4b5
                                                                                                • Opcode Fuzzy Hash: cbe55ff6d959e4d3dd3ba5fc265a7d739a75699713a5186b10576ef4775a140b
                                                                                                • Instruction Fuzzy Hash: A2315174B001048FDB14CF69C858AAEBBF2EF89354F14866AE406EB361DB31DD01CB90
                                                                                                Function 016E8E00 Relevance: .1, Instructions: 84COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 7f6267a0300aa637ae4b21ab026548f492c369c35ec524b6c5f79cd71a7ed10a
                                                                                                • Instruction ID: 94c8642f2b14266ee5761a54d6fe2a63bb79a739777a13da369f982f5f06cef0
                                                                                                • Opcode Fuzzy Hash: 7f6267a0300aa637ae4b21ab026548f492c369c35ec524b6c5f79cd71a7ed10a
                                                                                                • Instruction Fuzzy Hash: 0F31E7306007058FD734DF2AD84866ABBF5EF89320B204A2DD596DB7A1DB30E946CF80
                                                                                                Function 05C230B0 Relevance: .1, Instructions: 84COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: a63f60e1078158d55f721625219c667f81f82eb29be6e5e17e4c812c13640ea6
                                                                                                • Instruction ID: 30ba00111cd096aee3d69b9a7055041346ff7f77049d43bb8e585ff69f6bb072
                                                                                                • Opcode Fuzzy Hash: a63f60e1078158d55f721625219c667f81f82eb29be6e5e17e4c812c13640ea6
                                                                                                • Instruction Fuzzy Hash: 4521BF307003518BDB11DB6D8C80A6EBBF6EF8A650B84896AE515CF395EB74DD018BA1
                                                                                                Function 05C41698 Relevance: .1, Instructions: 84COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: dc7ad726607fa950d4f00e3956502751c4eb73956b1a5472679a0a0f6aad0f81
                                                                                                • Instruction ID: b98081618c0b9f356458fa08bd8019bc7c6ff73b2eb286b1df3fa2f20f7e53be
                                                                                                • Opcode Fuzzy Hash: dc7ad726607fa950d4f00e3956502751c4eb73956b1a5472679a0a0f6aad0f81
                                                                                                • Instruction Fuzzy Hash: 2231CC7960410AAFDB24CF58D884FEF37FAEB89300F144128E806DB685D731AD80CBA0
                                                                                                Function 016EB7F9 Relevance: .1, Instructions: 83COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: fb340a824491301e7a18161b6d2df0e77e19ec134ebadb55396ebef7b0bd7e35
                                                                                                • Instruction ID: 85bb9d5d6ed4b03f6ce1b959c6d279e616e16b1b000a70793b6333ee316a7c79
                                                                                                • Opcode Fuzzy Hash: fb340a824491301e7a18161b6d2df0e77e19ec134ebadb55396ebef7b0bd7e35
                                                                                                • Instruction Fuzzy Hash: FD21A930301A068BE309EA6DEC6866F3AD7EBD5650B14832ED125CF348EFA49C0187E4
                                                                                                Function 016EB808 Relevance: .1, Instructions: 80COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 27b1cc114ef22d0c385249d610530043cb673269585e4060e4a7417348cdf5d8
                                                                                                • Instruction ID: 576a5ebdfd77b083d0a70d960677d344fae11195a9c33d50436528bff6baedb8
                                                                                                • Opcode Fuzzy Hash: 27b1cc114ef22d0c385249d610530043cb673269585e4060e4a7417348cdf5d8
                                                                                                • Instruction Fuzzy Hash: ED21AC303016069FE319EA6DEC6856F7ADBEBD5A50314872ED125CF748EF609C0187E8
                                                                                                Function 05C228E3 Relevance: .1, Instructions: 78COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: a57dc8363342353125a19e642d36afc8b6b7dcd171c8e0e99b519fa80839294e
                                                                                                • Instruction ID: 4c66e0a1a9c32754aa7271ce7a51741199c9353c7fe7e1c3266ee0e483064e83
                                                                                                • Opcode Fuzzy Hash: a57dc8363342353125a19e642d36afc8b6b7dcd171c8e0e99b519fa80839294e
                                                                                                • Instruction Fuzzy Hash: 05215134B10215AFDB58AB61DC59B6EBBB6FF89700F148529F002AB2A4DF709841DB84
                                                                                                Function 016E90F8 Relevance: .1, Instructions: 77COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 10689b4179ed561fa4bb4cf72ae17fdc6e133d151ec2b61e49b7d59bd1190ac7
                                                                                                • Instruction ID: 5b0901690a5d7392df65be72d63b5db2cf198dc37306d9e4b7fa0671b728c717
                                                                                                • Opcode Fuzzy Hash: 10689b4179ed561fa4bb4cf72ae17fdc6e133d151ec2b61e49b7d59bd1190ac7
                                                                                                • Instruction Fuzzy Hash: 35214870B027018BDB34DF29DC4C6AABBF6AF88315B040B2DE55697794DB30E905CBA0
                                                                                                Function 05C28EF0 Relevance: .1, Instructions: 77COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 2ad012a58c6b9ed413c05b6eaead82d99f6fe38ac6be7c63c23f6e967d9ff61c
                                                                                                • Instruction ID: 12c9e23260143018370c52e8fb89ec66b9a0c841f6e65cb61c5d4ffd14b8cd90
                                                                                                • Opcode Fuzzy Hash: 2ad012a58c6b9ed413c05b6eaead82d99f6fe38ac6be7c63c23f6e967d9ff61c
                                                                                                • Instruction Fuzzy Hash: 3C21A0312007118FE729DBB8D85475ABFE6FB84350B044A1CC0869B691DFB5A848CB95
                                                                                                Function 05C2BBE3 Relevance: .1, Instructions: 74COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 438f4f31db59b5fb7307dff9a923b6f0a87c011768ee8cc2937bb5faa9248880
                                                                                                • Instruction ID: 56ac0f49fb1f991d3c2ab3a3f08190ceb664963f095eca4b478cd5a93ecde36c
                                                                                                • Opcode Fuzzy Hash: 438f4f31db59b5fb7307dff9a923b6f0a87c011768ee8cc2937bb5faa9248880
                                                                                                • Instruction Fuzzy Hash: 8A313934A003069FCB14DF68C88497EBBB3FB88315B598969E44AA7355DB30FC81CB90
                                                                                                Function 05C27A28 Relevance: .1, Instructions: 73COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 8050c5c4bed5ca431fa272ff55da14ce6b2d9368132bf693ec403e3885b6a907
                                                                                                • Instruction ID: 731911cce3fc41442bf4b74fd183e502eb762e00b26320992c59f493c85f7b21
                                                                                                • Opcode Fuzzy Hash: 8050c5c4bed5ca431fa272ff55da14ce6b2d9368132bf693ec403e3885b6a907
                                                                                                • Instruction Fuzzy Hash: 7D314C38A00219DFDB19DFA4D885ADCBBB2FF49310F0485A9E909A7320DB719D81DF90
                                                                                                Function 05C29D68 Relevance: .1, Instructions: 72COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 327f2c42da7758f1661cb3a9986f8fa449b0dd0773f8d4b5784fee2929385f3d
                                                                                                • Instruction ID: 7df1ed60d17518d46478fff338c4fa73b2837868ec9b4da2732b73e570618a41
                                                                                                • Opcode Fuzzy Hash: 327f2c42da7758f1661cb3a9986f8fa449b0dd0773f8d4b5784fee2929385f3d
                                                                                                • Instruction Fuzzy Hash: 7F11CB313002129BE719AA798C5065F7BA2FFC1B50F508E2CDA055B784DF755D06C3D9
                                                                                                Function 05C28F00 Relevance: .1, Instructions: 72COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 2f38e93e7b0d00944f56d9d0fc6b2625c6ed4bfb430829a208477deba9b5a8e4
                                                                                                • Instruction ID: 80fd12888b88d74a7edee8a4421c9f446bc5fd9075fee68f1603ec6bb33ff499
                                                                                                • Opcode Fuzzy Hash: 2f38e93e7b0d00944f56d9d0fc6b2625c6ed4bfb430829a208477deba9b5a8e4
                                                                                                • Instruction Fuzzy Hash: EA21C1312007118BE729EB78D84475EBBE6FB84310B444A2CC0468B790DFB5B845CBA4
                                                                                                Function 05C2D92B Relevance: .1, Instructions: 71COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 11ae69bf8d62e6bf6c45d89cbfa4850e8f632f38a4cf7840d46d53acacbba280
                                                                                                • Instruction ID: 0279c99d3d8c90059b0cb998a9302d8605bb8fc22c098b8cb2461afff237a273
                                                                                                • Opcode Fuzzy Hash: 11ae69bf8d62e6bf6c45d89cbfa4850e8f632f38a4cf7840d46d53acacbba280
                                                                                                • Instruction Fuzzy Hash: D4211D31A00208EFDB15DFA4D998AEEBFB6FF48310F149429F906E7254DB30A951CB90
                                                                                                Function 016E4F68 Relevance: .1, Instructions: 70COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 8f09c167dcb0a3e8d2502ee28b9bd77a535eb6495ad0ed50ad7066a5c9ca92da
                                                                                                • Instruction ID: b76cb5b33f709ff2050e08563c2cf92ef8ac90c415db4b6e4191cdb12c2705eb
                                                                                                • Opcode Fuzzy Hash: 8f09c167dcb0a3e8d2502ee28b9bd77a535eb6495ad0ed50ad7066a5c9ca92da
                                                                                                • Instruction Fuzzy Hash: 19218130600105DBDF28CF28DDC859A7FB5EF88324B044669E9169F2DAEB31D852CBE1
                                                                                                Function 05C40D63 Relevance: .1, Instructions: 70COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: b895737e597023652ae98a9440cf32db1a17cdace80e95b8bcc40ec7c4f42218
                                                                                                • Instruction ID: bc077ae25842c6e68299af560a68939f5be8f915afaa70b18bb06c849d791055
                                                                                                • Opcode Fuzzy Hash: b895737e597023652ae98a9440cf32db1a17cdace80e95b8bcc40ec7c4f42218
                                                                                                • Instruction Fuzzy Hash: EE21C335740621AFD728AB65DC59B69BBA2FFC8321F208924F65AD7690DB307C51CB80
                                                                                                Function 016E0A01 Relevance: .1, Instructions: 69COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 9b2e491710a83ce96e4b03f5058f57e4c602a3dbf669515be9f15c445dabe176
                                                                                                • Instruction ID: 31b4b905ef1e6182d9e6cfd7c04ea7b01baf99c540c41abb79590bbeb82f2b45
                                                                                                • Opcode Fuzzy Hash: 9b2e491710a83ce96e4b03f5058f57e4c602a3dbf669515be9f15c445dabe176
                                                                                                • Instruction Fuzzy Hash: CA21D271E012188FDB59CFAAD8546EEBBF2FF89310F04C16AD414A7264EB745942CF50
                                                                                                Function 05C23E60 Relevance: .1, Instructions: 69COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: de0130e23ee0d1dd379b8e0f4280fa07d5ffe4cb06330f82a6be25e4df383ac9
                                                                                                • Instruction ID: dfe37c81f025d9620f1b211e027a954929e90c8e5d554731b80209b22b2187b5
                                                                                                • Opcode Fuzzy Hash: de0130e23ee0d1dd379b8e0f4280fa07d5ffe4cb06330f82a6be25e4df383ac9
                                                                                                • Instruction Fuzzy Hash: DE218C753403109FD705EB68E89586ABFB6FFC6620314896EEA098B361DEB4DC05CB94
                                                                                                Function 05C2BBDB Relevance: .1, Instructions: 69COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 6167381df16fc392e7671a3e4c24a3f5777505926230c8d698bd01cf4ba654a6
                                                                                                • Instruction ID: 414c7240ac0a1c1fe82f9b5020d5e010acaa6c3b7649406126bee80cfdc58ff6
                                                                                                • Opcode Fuzzy Hash: 6167381df16fc392e7671a3e4c24a3f5777505926230c8d698bd01cf4ba654a6
                                                                                                • Instruction Fuzzy Hash: 69212A74A003169FCB14DF68C884A6EBBB3FB88315B558965E05AE7355DB34EC81CB90
                                                                                                Function 05C27B83 Relevance: .1, Instructions: 66COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 663595443bdad001a275cd90b24cadd6896a878bbfbeae7b82bd81deb2604a16
                                                                                                • Instruction ID: 2ed8f70dd498e3bf99b1c8d54bdb7871dbcc29b321e5972b48534b3230709a72
                                                                                                • Opcode Fuzzy Hash: 663595443bdad001a275cd90b24cadd6896a878bbfbeae7b82bd81deb2604a16
                                                                                                • Instruction Fuzzy Hash: 04213C71E0130A9BCB44DFB5D8446DEFBB5FF99300F508A2AD915A7240EF70A945CBA4
                                                                                                Function 05C42570 Relevance: .1, Instructions: 66COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: d842993aeb01c87e9f3131999477d117fd6663afa3d89051a4947fafe4366e28
                                                                                                • Instruction ID: 17ccdd450bedf5055a4d800e2ab3c75a8f73cc4e0558aa62c27cbdea5d258f34
                                                                                                • Opcode Fuzzy Hash: d842993aeb01c87e9f3131999477d117fd6663afa3d89051a4947fafe4366e28
                                                                                                • Instruction Fuzzy Hash: C511DA717002129BDB15DBA8EC8195EBBE6EFC0260744CA6DE505DF350DF70DC408BA4
                                                                                                Function 016E4E18 Relevance: .1, Instructions: 64COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 294393faab3809e7081dba7c4749605e0869399d13906daf4648f291282666fd
                                                                                                • Instruction ID: d46c1a9512b8c67f7aed4344035442316508d72db38d2dfb1a390d70bede8541
                                                                                                • Opcode Fuzzy Hash: 294393faab3809e7081dba7c4749605e0869399d13906daf4648f291282666fd
                                                                                                • Instruction Fuzzy Hash: E0212A302047058FD735CF6ADC4899ABBF1EF88320B004B2DD5529B6A5DB31E94ACF80
                                                                                                Function 016ECE98 Relevance: .1, Instructions: 64COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 408908c6fd755570810401559db1170b6c335f650ca4c461a3175cb5acdbb449
                                                                                                • Instruction ID: 2a6706d6941d695786b4dbe68e86d46bd36296f67cdf5cd2d05c4c2fb796c884
                                                                                                • Opcode Fuzzy Hash: 408908c6fd755570810401559db1170b6c335f650ca4c461a3175cb5acdbb449
                                                                                                • Instruction Fuzzy Hash: A511BE763042008FDB19DB6CD884A2A7BE3FFC9210B25865DE559CB741CB31EC058B51
                                                                                                Function 05C200E8 Relevance: .1, Instructions: 64COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 47d3a5804e27c24d902be1f4cd161ff16822480d91018d7333b5f9eb830eab07
                                                                                                • Instruction ID: 25514cc8a086803cb38167af66215f14786faa1285ee926cbb2e2bcfc5b918ce
                                                                                                • Opcode Fuzzy Hash: 47d3a5804e27c24d902be1f4cd161ff16822480d91018d7333b5f9eb830eab07
                                                                                                • Instruction Fuzzy Hash: 211106327002258BCB18A76C9C84A6EFBE6EFC9660B808A3FD509D7341DE70EC0587D1
                                                                                                Function 016EA518 Relevance: .1, Instructions: 62COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 837dbf7a33ef9c44b0cda050193b3fabf78895a2cf4474384ceb30bfbebbb4d4
                                                                                                • Instruction ID: f09d22c955e80e689691357e9a437058cc4f437c698b2db7413514f7e2040488
                                                                                                • Opcode Fuzzy Hash: 837dbf7a33ef9c44b0cda050193b3fabf78895a2cf4474384ceb30bfbebbb4d4
                                                                                                • Instruction Fuzzy Hash: 5311A936B01615DBCF248A9CDC185AEBFE6DBC4651B05857ADA0AAB320D731D825CBD0
                                                                                                Function 016ECEA8 Relevance: .1, Instructions: 61COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: c6c59d5791ce0738e332b32c67896fe4e1e053a5e827428d176ad99fed94775c
                                                                                                • Instruction ID: 510910f9c37edb9ae9d71ebc79dfd3d8494dcc696ca4cdea453da51a46bd3a76
                                                                                                • Opcode Fuzzy Hash: c6c59d5791ce0738e332b32c67896fe4e1e053a5e827428d176ad99fed94775c
                                                                                                • Instruction Fuzzy Hash: A0113A753002019FDB29DB6DD884A6A7BE7FFCD264B64862DE54AC7740DB31EC028B91
                                                                                                Function 05C22150 Relevance: .1, Instructions: 61COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 4db7dd074feb82563b7be98c513d7112541e164e89e133d115573201a9f8733e
                                                                                                • Instruction ID: 47dcf67034678543cc6ac3a83194a49ae47df6f3985d4cd5870d3c7fb6d5c94e
                                                                                                • Opcode Fuzzy Hash: 4db7dd074feb82563b7be98c513d7112541e164e89e133d115573201a9f8733e
                                                                                                • Instruction Fuzzy Hash: 06219074A00306DFDB04DBA8D8819AEBBB1FF89204B408969D605DB314DF30AD05CFD4
                                                                                                Function 05C2AF38 Relevance: .1, Instructions: 61COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: c46176b1f8b435444cc16e01456b117c8fc250dfe61e04ec4fec7d7a149c92c9
                                                                                                • Instruction ID: fcee7a1dd67998077762c725e2401d67458f6598f7df82ae721ed091055962a8
                                                                                                • Opcode Fuzzy Hash: c46176b1f8b435444cc16e01456b117c8fc250dfe61e04ec4fec7d7a149c92c9
                                                                                                • Instruction Fuzzy Hash: D11159723093914FD7059B64985072E7BA2DFC5A20F6445AAD508CB2C2CF24ED87C795
                                                                                                Function 05C42580 Relevance: .1, Instructions: 61COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: eb623db1b0a72c8a3f9d9d9eaa3c676f0da2e7416940c07504578471c4094241
                                                                                                • Instruction ID: efc81367714ce6c71e7327a41dd22acba28f543ef88dcfede8624caa106aafe1
                                                                                                • Opcode Fuzzy Hash: eb623db1b0a72c8a3f9d9d9eaa3c676f0da2e7416940c07504578471c4094241
                                                                                                • Instruction Fuzzy Hash: 201186713002129B9B15ABA9DC8095ABBE6EFC45607448A2DE9059B355DFB0EC448BE4
                                                                                                Function 05C22160 Relevance: .1, Instructions: 60COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 76d67a52f82f8dcb9868931b5abd430e7f3163e529ed367ced5a5cad2a95b34a
                                                                                                • Instruction ID: bfee6496c71e7de57d096aa2c1b7b4847bdd47958a073f8da7f0c205e3e165cc
                                                                                                • Opcode Fuzzy Hash: 76d67a52f82f8dcb9868931b5abd430e7f3163e529ed367ced5a5cad2a95b34a
                                                                                                • Instruction Fuzzy Hash: 72118470700209DFCB14DB68DC819AEBBB5FFC9214B408929E6199B304DF70AD01CBD4
                                                                                                Function 016EA509 Relevance: .1, Instructions: 59COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 6a63bcba10710df05dd011e8d39665372c8d5c2f7473c484bf8b9ab06f044cd0
                                                                                                • Instruction ID: d03779f9e241918926a173a0638a712c3fb3f1d109fcaae849acaee955860bdc
                                                                                                • Opcode Fuzzy Hash: 6a63bcba10710df05dd011e8d39665372c8d5c2f7473c484bf8b9ab06f044cd0
                                                                                                • Instruction Fuzzy Hash: F711E536A016149BDB108B98CC1856A7FE6DFC9311F098579DA0AAB361D7358815CB80
                                                                                                Function 016E7B62 Relevance: .1, Instructions: 59COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: f27a8adb30b0a98308151fd5742bf74328604b1400fa2f38f9bb9c8a785286dc
                                                                                                • Instruction ID: 9a2703e359a70a197c9db500160cacba4f1db799fa9e3ba982b6d6e9e9e5dcbb
                                                                                                • Opcode Fuzzy Hash: f27a8adb30b0a98308151fd5742bf74328604b1400fa2f38f9bb9c8a785286dc
                                                                                                • Instruction Fuzzy Hash: 3D11C6313496464FD723CB2CDC606AA7FF6EF82321B19469BD444CB392EB68AC15C791
                                                                                                Function 05C2B008 Relevance: .1, Instructions: 59COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: b07376a866c9024a6c6e49d580e8fe56bbadaaef9a19049e9158c64d8b1e6c88
                                                                                                • Instruction ID: a70e3802bd26f33c72d1c4ea3b390313fe34f8cd2aa7658034362c9cc6873430
                                                                                                • Opcode Fuzzy Hash: b07376a866c9024a6c6e49d580e8fe56bbadaaef9a19049e9158c64d8b1e6c88
                                                                                                • Instruction Fuzzy Hash: 8101D4717042159F97186FAD981056FB7EBFFC4A50314462EE505D7380DE305C01C3A9
                                                                                                Function 05C27922 Relevance: .1, Instructions: 59COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 3548789df5c693bd36c4c83c220640c0ad4291651d7599e16f5a521ff7232f4d
                                                                                                • Instruction ID: 87ec11617e9bb600e425a8167816f44886e2cf8d0d1a11708a7aa79f05d2d8a1
                                                                                                • Opcode Fuzzy Hash: 3548789df5c693bd36c4c83c220640c0ad4291651d7599e16f5a521ff7232f4d
                                                                                                • Instruction Fuzzy Hash: 8621F974A00229CFDB64DF24D898B99BBB6FB49311F108599E809A7350CF709E81CF94
                                                                                                Function 016E0839 Relevance: .1, Instructions: 55COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 94ffbe9bd8a2d9008c1f68b7e51549edeee0bb67184784ad60fd63819ca4a1c9
                                                                                                • Instruction ID: a301063b60ffca6142583637e0b0cc047f01b755ab56dc333122967dcc4d944c
                                                                                                • Opcode Fuzzy Hash: 94ffbe9bd8a2d9008c1f68b7e51549edeee0bb67184784ad60fd63819ca4a1c9
                                                                                                • Instruction Fuzzy Hash: 9E116074E01249DFDF04DFA8D8559AEBBB2FF89200F008599D814E7351DB359A11CF65
                                                                                                Function 05C41D1B Relevance: .1, Instructions: 54COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: e7722d693f073cff56aba8ddb78d5c9af601deb798a7da504d4d8f97aa73ddda
                                                                                                • Instruction ID: f8add6c1613ded1426592c85c2f00b0760623eb95bc0d64273e1eac9ac4867e9
                                                                                                • Opcode Fuzzy Hash: e7722d693f073cff56aba8ddb78d5c9af601deb798a7da504d4d8f97aa73ddda
                                                                                                • Instruction Fuzzy Hash: 780171773005108B9748DA6DF894C6AB7ABFBC8661358847AE505C7315CE76DC12C798
                                                                                                Function 05C2AE48 Relevance: .1, Instructions: 52COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: f388fb4139b0a35d8ddee6a0af2f03aecfbb763a349993905a2151a2b70a70fb
                                                                                                • Instruction ID: 15c33a26368ea548a676e7a32234ce2b45c34dc3fba2bdce9e5301575da36c6b
                                                                                                • Opcode Fuzzy Hash: f388fb4139b0a35d8ddee6a0af2f03aecfbb763a349993905a2151a2b70a70fb
                                                                                                • Instruction Fuzzy Hash: 02115B353006148FD324DB5AC884A6BB7FAFF88624B59891DE156CB760CB70FC01CB90
                                                                                                Function 05C47D4B Relevance: .1, Instructions: 52COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 74bf61265e1c17f7f40e4a8c136512e09cac3932109cde89b3deedb67fdbf0fb
                                                                                                • Instruction ID: 11d897de02ca9f315fffd1e95abe1891fdada41561f4aa854b27354c56f36a47
                                                                                                • Opcode Fuzzy Hash: 74bf61265e1c17f7f40e4a8c136512e09cac3932109cde89b3deedb67fdbf0fb
                                                                                                • Instruction Fuzzy Hash: AC018432B102198B8B10DAA5EC585BEBBB6FBC8261B144525F916E3280DB745D118B91
                                                                                                Function 05C24539 Relevance: .1, Instructions: 51COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 511aa349b90b206f4c9936471dc4e610a592d12d71455807848e350c7f2e8f70
                                                                                                • Instruction ID: 69e17d17253f749f60fb5573caf3454cecd0cb65b276cf1af18f1db1a9bfbb6a
                                                                                                • Opcode Fuzzy Hash: 511aa349b90b206f4c9936471dc4e610a592d12d71455807848e350c7f2e8f70
                                                                                                • Instruction Fuzzy Hash: 33014932304A6147DB09A6B8A89462E66CBABC6931B540D7DE21EDB780DEA98C025395
                                                                                                Function 05C21308 Relevance: .1, Instructions: 51COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: b4f0093c01de6ee43f973eb7cde87d04de3ae784c127bb3b28f46c9fe877cfc8
                                                                                                • Instruction ID: b67d4cff18e5e047b3bc112a127c7861d3ab95930c92516c70dc040a716804cf
                                                                                                • Opcode Fuzzy Hash: b4f0093c01de6ee43f973eb7cde87d04de3ae784c127bb3b28f46c9fe877cfc8
                                                                                                • Instruction Fuzzy Hash: A911E531E14219CFDF14DBA8D854AEDBBB2BF89310F00146AD505BB3A0DB742944CBA1
                                                                                                Function 05C47CBB Relevance: .1, Instructions: 51COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 1e56fc2b6b1cc453118970e643100fe5501e3b1d2505334452be7a3e2f3514a8
                                                                                                • Instruction ID: dbf32cdaa5621a1a82048452c86a9b3fdb5647c69de6945fddea368a767cc096
                                                                                                • Opcode Fuzzy Hash: 1e56fc2b6b1cc453118970e643100fe5501e3b1d2505334452be7a3e2f3514a8
                                                                                                • Instruction Fuzzy Hash: AF0148357002109FC708EB79D888C2EBFEAEFC92543598469E509CB365CE71EC029B90
                                                                                                Function 016E0848 Relevance: .0, Instructions: 50COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: fd639d61eeddda5bb3f0492babdbc2e486e288209c5df9b7d733c4cf08c44278
                                                                                                • Instruction ID: 81b951d62b961ab9a63c0d51eedc50109cffef9bdcf16c88c1997d7839524a2f
                                                                                                • Opcode Fuzzy Hash: fd639d61eeddda5bb3f0492babdbc2e486e288209c5df9b7d733c4cf08c44278
                                                                                                • Instruction Fuzzy Hash: BE112AB4E0120ADFDB44DFA9D954AAEBBF2FF88200F108569D515A7350DB34AA01CFA5
                                                                                                Function 05C2F8C0 Relevance: .0, Instructions: 50COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: ee869ddad29f75821d85aa618c833d543cc2e91b03bb23e6392e7bc44ffa84c8
                                                                                                • Instruction ID: 91a839008a622d46ba4174e2c7cdfb8b338c2330591b46a722036d04546f2816
                                                                                                • Opcode Fuzzy Hash: ee869ddad29f75821d85aa618c833d543cc2e91b03bb23e6392e7bc44ffa84c8
                                                                                                • Instruction Fuzzy Hash: 5201D6317003685FC710A6AEF415B6AF7AAEFC1664B04847BE18DCB611EB61C942C790
                                                                                                Function 05C47CC0 Relevance: .0, Instructions: 50COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 41dcad2d5c97818a46fb59743132156e985e83a6ddafc9d62e6d0bf1e49f770f
                                                                                                • Instruction ID: b95af650a2722032f34e32376a4aa5f92a14860317a182acac52410fdcb8ff0a
                                                                                                • Opcode Fuzzy Hash: 41dcad2d5c97818a46fb59743132156e985e83a6ddafc9d62e6d0bf1e49f770f
                                                                                                • Instruction Fuzzy Hash: 360156357002109FC708EB79D888C2EBBEAEFC92143598469E50ACB365CE71EC028B90
                                                                                                Function 05C472A0 Relevance: .0, Instructions: 49COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 34f0869eb66c7a61f3bbdb7ecdc7af6418f021b0abd0bc7d1de733b99a722b39
                                                                                                • Instruction ID: 589ce8fe18fdee85ebf39dba352c0579ef354007b36d1ee0e0f5ae1f7fc21230
                                                                                                • Opcode Fuzzy Hash: 34f0869eb66c7a61f3bbdb7ecdc7af6418f021b0abd0bc7d1de733b99a722b39
                                                                                                • Instruction Fuzzy Hash: 0E112770A002148FCB18DB68C418A9DBBF2FF88601F2408A9E402EB3A1CF759C42CB90
                                                                                                Function 05C2EE43 Relevance: .0, Instructions: 48COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 840e39cea8b45882638d104ac47eac92c4de85b575e9e8f59d3b44b7202c2025
                                                                                                • Instruction ID: ba2803cb0bca470268a151328e1c5c90ae1f352d005976324843627ca39a9b0c
                                                                                                • Opcode Fuzzy Hash: 840e39cea8b45882638d104ac47eac92c4de85b575e9e8f59d3b44b7202c2025
                                                                                                • Instruction Fuzzy Hash: E401D136341A207BE7205A56EC48F6BFFAAFBC5B10F148429F54ED2650CB20AC01C7A4
                                                                                                Function 05C47297 Relevance: .0, Instructions: 48COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 0e98db6ba2de4b217835110303764744f72c4ae83b86279ffdb853b4ee7bfc07
                                                                                                • Instruction ID: 32c5209dc314bcaa9387aa40542cae580afbd121c1db604d0eb09339bce87fe7
                                                                                                • Opcode Fuzzy Hash: 0e98db6ba2de4b217835110303764744f72c4ae83b86279ffdb853b4ee7bfc07
                                                                                                • Instruction Fuzzy Hash: 6A111875A00215CFCB18DB68C459A9DBBF2BF88601B6508A9E402EB761CF759D42CB90
                                                                                                Function 05C2E2F0 Relevance: .0, Instructions: 47COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 92d6ee43ebebf7f1898f3a613a392a373b51688ec3c2c76be9d6d482bde53785
                                                                                                • Instruction ID: 79f2096efffbe515b4658337a27d4cbdb939c6255c6bb41a25981d6fb1611eb5
                                                                                                • Opcode Fuzzy Hash: 92d6ee43ebebf7f1898f3a613a392a373b51688ec3c2c76be9d6d482bde53785
                                                                                                • Instruction Fuzzy Hash: EB0126363053904FE7169B69EDA496A7FA6EB81211348886EC145C7351DE689C058B64
                                                                                                Function 05C27E90 Relevance: .0, Instructions: 47COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 2ff568a4f2223ac3d362a28307c9181b4ef1760f622ec6d6fa9102a1dd14720b
                                                                                                • Instruction ID: 6bceebeb8f0b9e224ba69bf757d656d9211c74816ed403817c74c39b6da7ecdf
                                                                                                • Opcode Fuzzy Hash: 2ff568a4f2223ac3d362a28307c9181b4ef1760f622ec6d6fa9102a1dd14720b
                                                                                                • Instruction Fuzzy Hash: 9A01F2317002199B8718A2ADA85423E7BEBFBC5A20740892DD50AD7344DEB45C05C7A9
                                                                                                Function 0164D01D Relevance: .0, Instructions: 45COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2141580971.000000000164D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0164D000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_164d000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: a88bc4ca0d3cfb12283ad6ed6ecf7aa2ac062f1ec488debebf0e3600fb1a8d1d
                                                                                                • Instruction ID: 028942ea0713a355279612eaaafcf44d7bfc82ccc55ba4244765ae8181770214
                                                                                                • Opcode Fuzzy Hash: a88bc4ca0d3cfb12283ad6ed6ecf7aa2ac062f1ec488debebf0e3600fb1a8d1d
                                                                                                • Instruction Fuzzy Hash: C4012B71804340DBF7104E69CD80B67BF98DF51BA4F08C41AEE080B282C7B99442C6B1
                                                                                                Function 016E18B0 Relevance: .0, Instructions: 45COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: a3feacb298b657b143fd4825bc191371e9cfb22db6180c11b58824c71d5aa02f
                                                                                                • Instruction ID: 06edc30656996958b961b9611586148c81e1c530bb0f9802f265f8a1f25cc2bb
                                                                                                • Opcode Fuzzy Hash: a3feacb298b657b143fd4825bc191371e9cfb22db6180c11b58824c71d5aa02f
                                                                                                • Instruction Fuzzy Hash: 45019E302013119FD7269F6CEC5859E3FA2EFC2220309529EE9998B251DB3559459B91
                                                                                                Function 016E7B88 Relevance: .0, Instructions: 42COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: a030b9dce9b98aacf6ba60a6d9c6d8990e2b9b89b27257d377a10253deb61645
                                                                                                • Instruction ID: 7435bcd490753a05ee21973bc3c9a27ee0b197ddb856dd2868cac4cfac6005d3
                                                                                                • Opcode Fuzzy Hash: a030b9dce9b98aacf6ba60a6d9c6d8990e2b9b89b27257d377a10253deb61645
                                                                                                • Instruction Fuzzy Hash: E2F0F6353016165FEB25DA5DEC50A6F7BEAEBC4610B04422AE505DB340EF60EC018BD4
                                                                                                Function 016EBE60 Relevance: .0, Instructions: 42COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 527906d0450cba3d101c3420cffee7f065c700b28e454629cdbd7776a267a337
                                                                                                • Instruction ID: 3d3a17f4559bad09567f71d2aa78adabf4ef9ec83e2175490cbdebc9fee88e9d
                                                                                                • Opcode Fuzzy Hash: 527906d0450cba3d101c3420cffee7f065c700b28e454629cdbd7776a267a337
                                                                                                • Instruction Fuzzy Hash: 94014F347001448FC314DB6DD888E66BBE6EBCE364B688969E949CB351DF35EC028B91
                                                                                                Function 05C2B6DB Relevance: .0, Instructions: 42COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: b03c06c2df66811b761b89fd8b955da4d4a9c9b66104b6ce8162c795323ec086
                                                                                                • Instruction ID: 96af944a30a5eeb64da6df8e53d1a95e110d3420c7764ba22186c6b15f43c0cb
                                                                                                • Opcode Fuzzy Hash: b03c06c2df66811b761b89fd8b955da4d4a9c9b66104b6ce8162c795323ec086
                                                                                                • Instruction Fuzzy Hash: 71018B712002019FD318DBA9E880A5ABBF6FFC8260B14892DE909DB710DB71EC41CBA4
                                                                                                Function 05C225FF Relevance: .0, Instructions: 41COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: d061832a288584c85bf3a982685960204245a5be02eb171a6880ae7464d5304c
                                                                                                • Instruction ID: 3bf9753afa6e03a9feee4e2c091f969383c377aeee35a0ab729e56a41d60abc3
                                                                                                • Opcode Fuzzy Hash: d061832a288584c85bf3a982685960204245a5be02eb171a6880ae7464d5304c
                                                                                                • Instruction Fuzzy Hash: 910165719042598FCB00EFBCD8516DEBFF0EF4A200F14826AD858DB211E6319A068BC1
                                                                                                Function 05C2B6E0 Relevance: .0, Instructions: 41COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: d15435438cf7013a6a7cf283212f351fe14c428be3a51f346b80eaf2237e0e93
                                                                                                • Instruction ID: 867816e31d6ceaf8ea286176219e7b216fe6f00e19ca2d8bb1c548dfb7d17481
                                                                                                • Opcode Fuzzy Hash: d15435438cf7013a6a7cf283212f351fe14c428be3a51f346b80eaf2237e0e93
                                                                                                • Instruction Fuzzy Hash: 93014B756006019FD318DBA9E884A5ABBE6FFC8260714896DE5199B310DB71EC41CBA4
                                                                                                Function 05C24E15 Relevance: .0, Instructions: 41COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: c555a60863eb77898cbf2d816d1429478e77ed26693894dd7b31b0a27d1473e0
                                                                                                • Instruction ID: 82b2e0fce123a1b71a28081802a928c799ff5bb5f6030c994b0a22b166c74ccb
                                                                                                • Opcode Fuzzy Hash: c555a60863eb77898cbf2d816d1429478e77ed26693894dd7b31b0a27d1473e0
                                                                                                • Instruction Fuzzy Hash: 9C011E71910609DFCB11EFB8D94979D7FB4BF09201F01866AE555E7210FB309694CBD1
                                                                                                Function 016EF930 Relevance: .0, Instructions: 40COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 0b9ec34acb51db880ef4662a88509b51b90981eadf043b177ecb2df7b3ca1a55
                                                                                                • Instruction ID: 11d673e6617e4778466ddf851dd9abb56615a38f7c7df8205266357580f7de23
                                                                                                • Opcode Fuzzy Hash: 0b9ec34acb51db880ef4662a88509b51b90981eadf043b177ecb2df7b3ca1a55
                                                                                                • Instruction Fuzzy Hash: B3F0C2317012009FD314DB69EC909AFBBABFBD9760B14856EE9098B341CA769C02C3A0
                                                                                                Function 05C21290 Relevance: .0, Instructions: 39COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: d8ff2a13a85e44f15435c3efcbbe023cd8de0d0aeaeff4d87c385496de6ad68b
                                                                                                • Instruction ID: a7cd79d365f16305018ba38a87ec7571afd9801929ed12153f9279ddb0f98368
                                                                                                • Opcode Fuzzy Hash: d8ff2a13a85e44f15435c3efcbbe023cd8de0d0aeaeff4d87c385496de6ad68b
                                                                                                • Instruction Fuzzy Hash: 03F0B4753001109FD7549A6E9C58B2B7BAAFBCA714F148068FA09CB799CE709C06C7A4
                                                                                                Function 016EBE70 Relevance: .0, Instructions: 38COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 996b7f257a9945a0fd9cc2cf219c4ff1315395c0320c76bc680bbd5d1c53ff75
                                                                                                • Instruction ID: b431b55c09b2d6b6fdb003992a1d46edc373fea0dae1dd471b07eb440f111409
                                                                                                • Opcode Fuzzy Hash: 996b7f257a9945a0fd9cc2cf219c4ff1315395c0320c76bc680bbd5d1c53ff75
                                                                                                • Instruction Fuzzy Hash: FDF01D347001408F8314DB6DD488D26BBE6EFCD6A53658969E549CB355DB31EC028B91
                                                                                                Function 05C29A60 Relevance: .0, Instructions: 38COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 13b0859a5161897d928e5668a561c8de98ec0402a093ddc75fa815cce5a313a7
                                                                                                • Instruction ID: 7b7abde5546fbfc4cbac714d0e0c777b1870695352b07c6d12c16d5da4774704
                                                                                                • Opcode Fuzzy Hash: 13b0859a5161897d928e5668a561c8de98ec0402a093ddc75fa815cce5a313a7
                                                                                                • Instruction Fuzzy Hash: 75F0C271614309DFD310EFE0A80A73DBBA5EB92211F0041A6ED0597340CE325CA0C7E6
                                                                                                Function 05C2A8FB Relevance: .0, Instructions: 37COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 5816d0413e811ca47bc3db29a97ff348b12d1014aa4a7ee0a1e6b607d5d39284
                                                                                                • Instruction ID: 3c84f370d8ff01e7f717362a66f0935586b81e11d2867bb78a1a8de4d71d5b48
                                                                                                • Opcode Fuzzy Hash: 5816d0413e811ca47bc3db29a97ff348b12d1014aa4a7ee0a1e6b607d5d39284
                                                                                                • Instruction Fuzzy Hash: 63F0C83210020597D314EA1ED98094BFFB5FFC4714B409E2CDA4D87614DEB1AD0587D4
                                                                                                Function 0164D01C Relevance: .0, Instructions: 36COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2141580971.000000000164D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0164D000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_164d000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 7a0103cbc677c68c15d1fd5fb03f057ae056504a3ab173730f8e372e35ca311c
                                                                                                • Instruction ID: 4738f6c9149e96be5979e46e5f645492cf75b89cf191ae98ac50f73048b7819d
                                                                                                • Opcode Fuzzy Hash: 7a0103cbc677c68c15d1fd5fb03f057ae056504a3ab173730f8e372e35ca311c
                                                                                                • Instruction Fuzzy Hash: 75F0C271404344AFE7108E19DC84B62FF98EB51674F18C45AED480B282C3799841CAB1
                                                                                                Function 016E4632 Relevance: .0, Instructions: 35COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 874dae24feec04f948264a6628810f3f39f2150abf34754c14424380144f4164
                                                                                                • Instruction ID: d40eebbecc79d87c047856a6131eadb87fa4cc056efb2039843c0724d5a71885
                                                                                                • Opcode Fuzzy Hash: 874dae24feec04f948264a6628810f3f39f2150abf34754c14424380144f4164
                                                                                                • Instruction Fuzzy Hash: C6017C70A0125ACFE754DB68D858B9CBBF2BB44308F244698D0159B261CFF99D4ACF81
                                                                                                Function 05C2E390 Relevance: .0, Instructions: 35COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: d713b167e42afdeb92b5e8f17bd0b08fbc6e703949622bd74afad0f100144db8
                                                                                                • Instruction ID: 33476b291f74fee234092e2936cf1ae713721bf1fb29c07275b371a6a6d43303
                                                                                                • Opcode Fuzzy Hash: d713b167e42afdeb92b5e8f17bd0b08fbc6e703949622bd74afad0f100144db8
                                                                                                • Instruction Fuzzy Hash: 09F0C2363043148FD714CAA8D84095ABBA5EF892643008A2AE509CB350DB70ED05C790
                                                                                                Function 05C212A0 Relevance: .0, Instructions: 35COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 494376cb58cdb2f13ff6a3a9137e187fb0e290f7d54cbf7e1169be36800cff13
                                                                                                • Instruction ID: ae390ba43cb5f10428d0be257ed0c321a90027332b938b2598d836f18f444b76
                                                                                                • Opcode Fuzzy Hash: 494376cb58cdb2f13ff6a3a9137e187fb0e290f7d54cbf7e1169be36800cff13
                                                                                                • Instruction Fuzzy Hash: 9AF082353001109FD7549A6E9858B2B7BAAFBC9710F208069F609CB399CE609C01C7E4
                                                                                                Function 05C2B9E9 Relevance: .0, Instructions: 35COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 67de119c7e620cab9a23ccb7f6aedd8ce015af9881bfc8a9a3c4320f3060ea5a
                                                                                                • Instruction ID: 07fb29b449a805f218fea6551497d2654fef10e158c9479f9efb81c900c64f3b
                                                                                                • Opcode Fuzzy Hash: 67de119c7e620cab9a23ccb7f6aedd8ce015af9881bfc8a9a3c4320f3060ea5a
                                                                                                • Instruction Fuzzy Hash: B8F0B4357003249FC714DF98E884D1DBBE6FB88365715896AE148CB351EB75EC00CBA4
                                                                                                Function 05C2DA61 Relevance: .0, Instructions: 35COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 3544042a70c433cc9f09e7fec1b260e5fc4c0d707a486728ff8a7e8b2fd9e04d
                                                                                                • Instruction ID: ad3ab5d08e462543c71c28a394255eec11608faf9bd3f2b48064cfd521eb3ee6
                                                                                                • Opcode Fuzzy Hash: 3544042a70c433cc9f09e7fec1b260e5fc4c0d707a486728ff8a7e8b2fd9e04d
                                                                                                • Instruction Fuzzy Hash: DDF08C323012149BDB05EB29E894A5F7B7AEFC6350BA48525E9048B365CE749C06CBD4
                                                                                                Function 05C2B003 Relevance: .0, Instructions: 34COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 84492e0b15397131c407b916f8a37c988c26096ad258c65cbe41137db13abf56
                                                                                                • Instruction ID: 305002a4c3ebbdceff18a665d7aec35a5dcf1576434c60bcedb231a2e3ce2242
                                                                                                • Opcode Fuzzy Hash: 84492e0b15397131c407b916f8a37c988c26096ad258c65cbe41137db13abf56
                                                                                                • Instruction Fuzzy Hash: E3F0A7B1704214AF57149E99AC8496FFBFEFBC8AA13140A2EF509D3300DF716C0087A8
                                                                                                Function 05C2E3A0 Relevance: .0, Instructions: 34COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: bbddd03a95ff3f979efa71b6e827a53e2fa48750fabeb2e4b931fa81508d872f
                                                                                                • Instruction ID: 65792f3c5d33ab7dba112c1984965148b7ffd0d75dc251388d5a82c299995055
                                                                                                • Opcode Fuzzy Hash: bbddd03a95ff3f979efa71b6e827a53e2fa48750fabeb2e4b931fa81508d872f
                                                                                                • Instruction Fuzzy Hash: DFF05E353003149F9714DAADD884D5EBBEAEFC96A03508A2AF519CB350DA71ED4187A0
                                                                                                Function 05C41C9B Relevance: .0, Instructions: 34COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 94f729f447f594ac4e38326d63a27be08c552fd23e63b8e6205c345bb75326bf
                                                                                                • Instruction ID: f432f5906700d2807d3fe9008a0123e19c6c04a6a668f25652f112c5fd168398
                                                                                                • Opcode Fuzzy Hash: 94f729f447f594ac4e38326d63a27be08c552fd23e63b8e6205c345bb75326bf
                                                                                                • Instruction Fuzzy Hash: B5F024B13003014BE7259EADEC80B5ABBE6EBC0360B4C882ED509C7310DFB49C018B84
                                                                                                Function 05C41CA8 Relevance: .0, Instructions: 34COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: e651a3d98f47ba8bca0bec4a3bc698aca0f010109c869bb67ae3098cec4692c0
                                                                                                • Instruction ID: 39256c500e278c45614436e93d3293854795ee9c60abbe998d11ee6279d10f2d
                                                                                                • Opcode Fuzzy Hash: e651a3d98f47ba8bca0bec4a3bc698aca0f010109c869bb67ae3098cec4692c0
                                                                                                • Instruction Fuzzy Hash: D9F0827130031157A6259E9EE890D5BBBEAEBD4660348892EE90987300DEB5AC418B94
                                                                                                Function 05C48181 Relevance: .0, Instructions: 33COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 0fd14308acf0be1903767fd6f8c7c341b5e50442fa60bddddb33ea1a871ffd96
                                                                                                • Instruction ID: 4ec172ea0b36c8548f519c73336cf406926eafc69096aac1dcc2e4555f6f768c
                                                                                                • Opcode Fuzzy Hash: 0fd14308acf0be1903767fd6f8c7c341b5e50442fa60bddddb33ea1a871ffd96
                                                                                                • Instruction Fuzzy Hash: 9EF0A7313100105FC7449B2EEC48F5AB7EAEFCDA21B144065F209CB361CEA1DC018790
                                                                                                Function 016E18D8 Relevance: .0, Instructions: 31COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: c2f6a8d6ff1459677a0c3782c3085fd365f0e9d862af2a1fe82f79509150108c
                                                                                                • Instruction ID: 19ee2bdb8990be13a7f8bde3a4c88f4b16348e361ba0d0f84e5e6eef0a3572e5
                                                                                                • Opcode Fuzzy Hash: c2f6a8d6ff1459677a0c3782c3085fd365f0e9d862af2a1fe82f79509150108c
                                                                                                • Instruction Fuzzy Hash: 74F08C313013019B9766DE6DEC0856F3BE6FBC6661704922DD94A87700EF34AC018B91
                                                                                                Function 05C23030 Relevance: .0, Instructions: 31COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: ad968b2ad5967423bbc80d700e4a0f0fe254ad4196fcf2f4b48bfdf3fff60d38
                                                                                                • Instruction ID: bb912b6a477f344e73dda0908df292a8e816c8e2f45a3dd3f48b18ba0229b1f0
                                                                                                • Opcode Fuzzy Hash: ad968b2ad5967423bbc80d700e4a0f0fe254ad4196fcf2f4b48bfdf3fff60d38
                                                                                                • Instruction Fuzzy Hash: 36F0AF30900265CBCF14DBA4C9193DDBBF1AB48621F100A29D802B32D0CB390940CBA5
                                                                                                Function 05C27D50 Relevance: .0, Instructions: 31COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 2b7df277d901baed99bd7e899d6cfd8cebc6e2e92d771d3d04c391c913e465c3
                                                                                                • Instruction ID: 207d7fc3d67015cd1bb1ae0997fc78b0f1d9bf6cf314e667d85f64f82fe2bf90
                                                                                                • Opcode Fuzzy Hash: 2b7df277d901baed99bd7e899d6cfd8cebc6e2e92d771d3d04c391c913e465c3
                                                                                                • Instruction Fuzzy Hash: ECF0E2363043104BD708D6B4E8ACB6BBBD5EBCA225F04952DE40AC3382DA749802C780
                                                                                                Function 05C27E80 Relevance: .0, Instructions: 31COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 073ae04c3ffcf3eb1b56e3529fd643fffba5f36f4b30c0a9b30a34908ff1a740
                                                                                                • Instruction ID: faa7710b29c6bc8d9ad71605e2aefcd59b05b26f89d102859d5c609e1a0c71d1
                                                                                                • Opcode Fuzzy Hash: 073ae04c3ffcf3eb1b56e3529fd643fffba5f36f4b30c0a9b30a34908ff1a740
                                                                                                • Instruction Fuzzy Hash: 29E0E52670065587E729626EA41472E2ECBABC6F10F14461ED509E7380CFAD5C0943A5
                                                                                                Function 05C2B980 Relevance: .0, Instructions: 31COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 96a28d8341ad61ab92b72c01140610853bea7800c06de7ff868865315897162c
                                                                                                • Instruction ID: 7b263e0fdb7530e8974eb05503b46c2c80c28d9dac16c7736b6cf3e30b3e24c5
                                                                                                • Opcode Fuzzy Hash: 96a28d8341ad61ab92b72c01140610853bea7800c06de7ff868865315897162c
                                                                                                • Instruction Fuzzy Hash: 8BF0B439304711DFC324AB75D928A267BF2EB883137058979E447D3354DB34AC81CB80
                                                                                                Function 05C48188 Relevance: .0, Instructions: 31COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 0bf572aea41f315d8d14190a7b49c7c27909b5228187c282627a591ab78ec7ae
                                                                                                • Instruction ID: f8bfff3d3077a39c8ccdea6cc78e02758baaeb34ea7405bc4a097bf2de80c255
                                                                                                • Opcode Fuzzy Hash: 0bf572aea41f315d8d14190a7b49c7c27909b5228187c282627a591ab78ec7ae
                                                                                                • Instruction Fuzzy Hash: E9E065353100145FC7449B6EE858E5ABBEAEFCDB21B214069F20DCB365CEA1DC018794
                                                                                                Function 05C46611 Relevance: .0, Instructions: 31COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: f9d67e990685bff2a1ce1d9d31efe91455ee58de804c569a92816fff01cbfaab
                                                                                                • Instruction ID: 9462e746141c5e77aeba637ce91dcd30966ffb3205a7b337856e3efbd5ca9a32
                                                                                                • Opcode Fuzzy Hash: f9d67e990685bff2a1ce1d9d31efe91455ee58de804c569a92816fff01cbfaab
                                                                                                • Instruction Fuzzy Hash: 22F0A0317002644FC708A77D989886ABBEAEFCA22132444AEE10AC7362CA208C028B50
                                                                                                Function 05C23040 Relevance: .0, Instructions: 30COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: e1c91f95a9a36e6cda89424f4d7b343fa86306e308735212d61e3a4f5108190d
                                                                                                • Instruction ID: d4b0586dec62f8b45a9a34b9296233ff0a6d9e6eb1646c8213fd44f52adcb9c2
                                                                                                • Opcode Fuzzy Hash: e1c91f95a9a36e6cda89424f4d7b343fa86306e308735212d61e3a4f5108190d
                                                                                                • Instruction Fuzzy Hash: 4EF017319402699BCF14DAA4C8196DEBAF6AF8D601F200929E802B7290CB790D44CBA5
                                                                                                Function 05C229FC Relevance: .0, Instructions: 30COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 439ae09d9bdea448a6abbbccada7a9548601692ca1edd4f09a789ff1d2a12f24
                                                                                                • Instruction ID: 2c93ffa94cdf0eab72f5cca42ddcd29e00ea5509a5b9f4d9f13105e25b18675b
                                                                                                • Opcode Fuzzy Hash: 439ae09d9bdea448a6abbbccada7a9548601692ca1edd4f09a789ff1d2a12f24
                                                                                                • Instruction Fuzzy Hash: 43F0203860820ADBE760FB54EC4ABBE7FA9BB02305F004929E042C2291CB318844CBC1
                                                                                                Function 05C2DA70 Relevance: .0, Instructions: 30COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: d16d46d208af69d2f581a56d152e51dd5859524adb328e1a5f3501a0097f6007
                                                                                                • Instruction ID: 354f759e5b5c9b5d913249b0f7cd2ccb4d9b54182d2f1c571c5d95e61fa47b32
                                                                                                • Opcode Fuzzy Hash: d16d46d208af69d2f581a56d152e51dd5859524adb328e1a5f3501a0097f6007
                                                                                                • Instruction Fuzzy Hash: 98F065313012149BCB05EB29E494D5F7B6AFFC63507E08525E9054B364CF709C06CBD5
                                                                                                Function 05C2DA06 Relevance: .0, Instructions: 29COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: aef55a7320bee0b50451147be5b0499a09ce968eac592baa02a13566d54ec853
                                                                                                • Instruction ID: c870976a33d9e03f6be9a653ddaad0898efc41321cd6029fc2ea22cb24e3848a
                                                                                                • Opcode Fuzzy Hash: aef55a7320bee0b50451147be5b0499a09ce968eac592baa02a13566d54ec853
                                                                                                • Instruction Fuzzy Hash: E9F0F931A14118DFDB10CFA5E448AEC7BB2FB58351F148425E807A6240D7319A45CF50
                                                                                                Function 05C40D5B Relevance: .0, Instructions: 28COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: d4b95368525591d0cfddc076b59fed1afd18e93b45473dea5f932d77d6fab00a
                                                                                                • Instruction ID: 93537a27a772b4d2fe6b52f489c9be25c203e952b7002c4334cdd9c591b4c645
                                                                                                • Opcode Fuzzy Hash: d4b95368525591d0cfddc076b59fed1afd18e93b45473dea5f932d77d6fab00a
                                                                                                • Instruction Fuzzy Hash: 8EF0E53A380220AFD71467A1EC09769BB62EBC4721F204524F2569A2C4CB746891CB40
                                                                                                Function 05C43ED0 Relevance: .0, Instructions: 28COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: efbf7f3023c646bb91eb3025a7b1406540b80e76a58f24185a87b87f85ec6b05
                                                                                                • Instruction ID: 05472aee8aa9b7ac01ef83aacbb9d2f4216e3ccf4fec18c0530a406ad7d94406
                                                                                                • Opcode Fuzzy Hash: efbf7f3023c646bb91eb3025a7b1406540b80e76a58f24185a87b87f85ec6b05
                                                                                                • Instruction Fuzzy Hash: 15E04F317002145BC71826AA6C5966BBEEBEBC8625B2098B9EA0AC3394DD718C0182D4
                                                                                                Function 05C24548 Relevance: .0, Instructions: 27COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 047b14a74378d19e2eea782a6e3b54253856d86bfc5cc60580296e005af98cf4
                                                                                                • Instruction ID: d834e151e0cfa16078866b327e6048236d7da674d535f42b75eb9b5ec2060ba9
                                                                                                • Opcode Fuzzy Hash: 047b14a74378d19e2eea782a6e3b54253856d86bfc5cc60580296e005af98cf4
                                                                                                • Instruction Fuzzy Hash: EAE08631704764674B1865EE649852EA9CFEBC9961754087DE70EC7340DEE58C0543E8
                                                                                                Function 05C23535 Relevance: .0, Instructions: 27COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 7fe2cd1c18a1fb055ba672a035cc2b1e5788445427cf57c96e83460f5f3697ed
                                                                                                • Instruction ID: 9ad592f80a3b1a0035cd401ba1a60105d54ff58f5c9439c8c537234596e38998
                                                                                                • Opcode Fuzzy Hash: 7fe2cd1c18a1fb055ba672a035cc2b1e5788445427cf57c96e83460f5f3697ed
                                                                                                • Instruction Fuzzy Hash: DFE06535B100248F8B14EB7CD4554ADB3B6BF88A11710896AD507E7364CE70DD0187D0
                                                                                                Function 05C22630 Relevance: .0, Instructions: 27COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 906c6a12d34b5ba7b3393549d1221d3b6eed8942e4d6a8dbfcad58e8d2b76055
                                                                                                • Instruction ID: 410404b7ad236ad034487e71af6fb01c118c6c8078f03317144a648f78680688
                                                                                                • Opcode Fuzzy Hash: 906c6a12d34b5ba7b3393549d1221d3b6eed8942e4d6a8dbfcad58e8d2b76055
                                                                                                • Instruction Fuzzy Hash: 03F0B271E00219DF8B40DFADC84069EFBF5EF49200B60C16AD918E7211E331AA128FC0
                                                                                                Function 05C2B92B Relevance: .0, Instructions: 26COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 57abf6766b50d848bfd124c5f209230e619ce8dcfd7e7df208f3c400db4b1dbe
                                                                                                • Instruction ID: 55549b855cd4f7865ddcc56e92257afffafc8737faf7c29e1aab7c651454372d
                                                                                                • Opcode Fuzzy Hash: 57abf6766b50d848bfd124c5f209230e619ce8dcfd7e7df208f3c400db4b1dbe
                                                                                                • Instruction Fuzzy Hash: 3AF0A031500715CFC724EB54E844F66BBF6EB41220F00DA2DE09A87711DBB4AD44CB80
                                                                                                Function 05C40D1B Relevance: .0, Instructions: 26COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 05f0cafff51fa97961ffc883b1ec05b00576fb304be934d23595fe533bc745f0
                                                                                                • Instruction ID: 6fbcce6e18a726817036e1776bc9d6dfa84ec638411a7a03767608ae5ce1dc95
                                                                                                • Opcode Fuzzy Hash: 05f0cafff51fa97961ffc883b1ec05b00576fb304be934d23595fe533bc745f0
                                                                                                • Instruction Fuzzy Hash: 33E08631740B2477C3256669AC09F17BBEADBC6F10F24486DF9099B781CE61AC42D7D8
                                                                                                Function 05C2B930 Relevance: .0, Instructions: 25COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: e8082e56565a0cb741821dccc98fe4e6c83577c93fb89c514a401660520bd2f1
                                                                                                • Instruction ID: 23b2e6957027729f8a70a485bdcdf5696a132f4a96538e2bb1310f1e4018e59c
                                                                                                • Opcode Fuzzy Hash: e8082e56565a0cb741821dccc98fe4e6c83577c93fb89c514a401660520bd2f1
                                                                                                • Instruction Fuzzy Hash: E5F03930600725CFDB24EB64E844E66BBE6EB81625F00DA2DE19A87611DBB4AD44CB80
                                                                                                Function 05C40D20 Relevance: .0, Instructions: 25COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 2aba5f38d4fb44d7a3a90757526439d97727502c90d4f0f767970ebb2c4c260d
                                                                                                • Instruction ID: a58e3c609ed5aacbe7538428d6fb5633ba5a090ca5cb245e2f31967536233b54
                                                                                                • Opcode Fuzzy Hash: 2aba5f38d4fb44d7a3a90757526439d97727502c90d4f0f767970ebb2c4c260d
                                                                                                • Instruction Fuzzy Hash: EEE0863174072067C32566659C05F17BBEADBC5F10F20446DF5095B7808E61AC42D7D8
                                                                                                Function 05C23350 Relevance: .0, Instructions: 23COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: be91abb61f61646b5f7c998060bc404d731209e929f43e06a80622132a3eebac
                                                                                                • Instruction ID: d9f713a55eeb07ab36038d2e9dad0e8a6d774fafe5c9ab6df73885dabda92b9f
                                                                                                • Opcode Fuzzy Hash: be91abb61f61646b5f7c998060bc404d731209e929f43e06a80622132a3eebac
                                                                                                • Instruction Fuzzy Hash: A2E03271D00219AFCB80EBA8E8056EEBBF4EB08200F00846ADA18E7341E3745A06CBC0
                                                                                                Function 016ED529 Relevance: .0, Instructions: 22COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 3c8ed192381d710f1756fab76a6620d6544f8da451554cfe0c77dcb0d9fcbdd6
                                                                                                • Instruction ID: 7a15a24984e5281e8d68d597cd8788ed65ff27ec3f0c2b10b2a8689d044ba925
                                                                                                • Opcode Fuzzy Hash: 3c8ed192381d710f1756fab76a6620d6544f8da451554cfe0c77dcb0d9fcbdd6
                                                                                                • Instruction Fuzzy Hash: 5DE0C934E14248EBEB45EFA8D845BADBFF0AB45304F0085ADE41897350DA744A05CF85
                                                                                                Function 05C245A0 Relevance: .0, Instructions: 22COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 1719162bf734ca102b11b357d0e7fd0cb28797dc6426bb7d4fb172f7d21663ac
                                                                                                • Instruction ID: 24232bf03ae3c3ab3787a06524beacee845b8b736fb189e2af1d9b247bee799c
                                                                                                • Opcode Fuzzy Hash: 1719162bf734ca102b11b357d0e7fd0cb28797dc6426bb7d4fb172f7d21663ac
                                                                                                • Instruction Fuzzy Hash: CDE01A31D00318ABCB40DBAAD8457DDBBF5AB05211F1085AAE99AE7240E731AA108B91
                                                                                                Function 05C28E6C Relevance: .0, Instructions: 22COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: ab803f935b7e6c936001b5b870207b9fef9c32b57b038051c8150b83471ce726
                                                                                                • Instruction ID: af2cc3d574c537faafcda2d9e53f4d15aeb881b9fd3a66ece71d83986966874d
                                                                                                • Opcode Fuzzy Hash: ab803f935b7e6c936001b5b870207b9fef9c32b57b038051c8150b83471ce726
                                                                                                • Instruction Fuzzy Hash: 4AE0863124116DBB8F05AE48D8408FE3F6AEF45660F405C16FD0142210CA71ED71BFD5
                                                                                                Function 05C45A9B Relevance: .0, Instructions: 22COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: c0f12f6467d71b6a8626e74a7cf45daf3d9c45007f2adb6886579800a8153b49
                                                                                                • Instruction ID: b0f8f131aad65bc787a1132c78e48a58b37a0536834a424e098867682bb38803
                                                                                                • Opcode Fuzzy Hash: c0f12f6467d71b6a8626e74a7cf45daf3d9c45007f2adb6886579800a8153b49
                                                                                                • Instruction Fuzzy Hash: B5E08C317102249B874DAB78E01591A77EAEB8A25635008B8E80AD7340CEB1EC01DBC8
                                                                                                Function 05C24591 Relevance: .0, Instructions: 21COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 53af3ff9da53e32a190eedd6ee2184b7fc29d880726091905fe7bbdd609a82df
                                                                                                • Instruction ID: ee748145d1444c783ae874e17f5aca94f516a85818347bdcc41cb74649f3f375
                                                                                                • Opcode Fuzzy Hash: 53af3ff9da53e32a190eedd6ee2184b7fc29d880726091905fe7bbdd609a82df
                                                                                                • Instruction Fuzzy Hash: 32E02B319043808BDB118BA4D4043D6BF61BB03274F2447EED1A6AB0D2D3319516DB41
                                                                                                Function 05C2A8B3 Relevance: .0, Instructions: 21COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 3d6be71b2e35b50328051dadfed4e8ebd302e4ad1fd2b82cdfea7d237d4460ea
                                                                                                • Instruction ID: 6876213a22d7a548ae9489138232e7c4bc5edd6256b7cb94a0cac89e3e4d8b84
                                                                                                • Opcode Fuzzy Hash: 3d6be71b2e35b50328051dadfed4e8ebd302e4ad1fd2b82cdfea7d237d4460ea
                                                                                                • Instruction Fuzzy Hash: 69E0263224016D6BCF029E88EC00EEE3F6AEF45660F044403FC0052351C631E971BBD0
                                                                                                Function 05C45AA0 Relevance: .0, Instructions: 21COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: cbd498f1dcf665643a98b0bdaa7578a1cf0b24130891d5f6bcccf30a034f2fe8
                                                                                                • Instruction ID: a139c2069eb826173f859791e991e852ab301fc9cc7b2d25993ac50145b3f2ee
                                                                                                • Opcode Fuzzy Hash: cbd498f1dcf665643a98b0bdaa7578a1cf0b24130891d5f6bcccf30a034f2fe8
                                                                                                • Instruction Fuzzy Hash: 86E0C2307002248FC74DAB78E01491A73E6FF8925631004BCE40AC7340CEB1EC01CBC0
                                                                                                Function 016EFF93 Relevance: .0, Instructions: 20COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 52cd4665efb9905d969f3e324b70b5cbb06ea67d749005f63d64aab7462a0dd1
                                                                                                • Instruction ID: 7ffe7b0f5c2e26b5c6860f9393e7aa3ad8a6f636d029244fb061e65ee2a730f6
                                                                                                • Opcode Fuzzy Hash: 52cd4665efb9905d969f3e324b70b5cbb06ea67d749005f63d64aab7462a0dd1
                                                                                                • Instruction Fuzzy Hash: 09E08C327057104BD3349AADBC44256BAD6EBCA261F94022EE209C33D0CA7088008B98
                                                                                                Function 016ED538 Relevance: .0, Instructions: 19COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 38c7ec654e2c44a21d90bf2d2176b63640f2434951e3265b78de801f067ce32d
                                                                                                • Instruction ID: b6e946c2a73cb3221ed86868f623c9bd8f84b5099d45abbd4b67aedda2e55c04
                                                                                                • Opcode Fuzzy Hash: 38c7ec654e2c44a21d90bf2d2176b63640f2434951e3265b78de801f067ce32d
                                                                                                • Instruction Fuzzy Hash: F4E09274E0420CAFCB44EFA9D44559DBFF5AB88300F0081AEE819A7350EA745A04CF85
                                                                                                Function 05C23360 Relevance: .0, Instructions: 19COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: dceb927568deca30e69580cb7ef5e084fe3457a52a9e985517ce35a1118f9f52
                                                                                                • Instruction ID: bf3fc95954926576cc189023bb606ae05899bdac528b507ac37a609afc08daf8
                                                                                                • Opcode Fuzzy Hash: dceb927568deca30e69580cb7ef5e084fe3457a52a9e985517ce35a1118f9f52
                                                                                                • Instruction Fuzzy Hash: 80E09271D002299F8B40EFA9A9055EEBBF4EA48210B10846ADA19E7240E7346A11CFC1
                                                                                                Function 05C2CF08 Relevance: .0, Instructions: 19COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 214039043dc775ade49caa68f5d47b91fa525c7f58a1229f0becd10be1076321
                                                                                                • Instruction ID: a9dc8224ca9394eb332dd666748d242a9753514b0426cc35621167405545dad2
                                                                                                • Opcode Fuzzy Hash: 214039043dc775ade49caa68f5d47b91fa525c7f58a1229f0becd10be1076321
                                                                                                • Instruction Fuzzy Hash: B7D0A73171062453C3042E78D84A7C6BB98D745535B14087DFC49C2740CD29EC07D6D4
                                                                                                Function 05C23A10 Relevance: .0, Instructions: 19COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 702f17b10ca15a7a1fd9719f28ef4ba80517140ec5776cd9c72e662f2f2ad70f
                                                                                                • Instruction ID: 40a3965ade886c00b13205b9a71790a7648db62dc8738b55d855459a100d5689
                                                                                                • Opcode Fuzzy Hash: 702f17b10ca15a7a1fd9719f28ef4ba80517140ec5776cd9c72e662f2f2ad70f
                                                                                                • Instruction Fuzzy Hash: C5D05E3170032497871466ADAC0852A7ADAD7CAA62B00053EFA0AC7340DEB59C118BA8
                                                                                                Function 05C46DD3 Relevance: .0, Instructions: 19COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 0f5a812be466248e8cdf22e20cc62a31e7c50ba14e0d1f1db67889045cfe3c55
                                                                                                • Instruction ID: d579388fe07a7a9dc4389b1f1467d557b73ec9247371cb0a7f62898524d84686
                                                                                                • Opcode Fuzzy Hash: 0f5a812be466248e8cdf22e20cc62a31e7c50ba14e0d1f1db67889045cfe3c55
                                                                                                • Instruction Fuzzy Hash: 32E01236200218AF87066BA0D809D8ABFA9DB0A250345847AF9059A221DA36D851EBD4
                                                                                                Function 016E0E7A Relevance: .0, Instructions: 18COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 47ad13db34c0f2121cece03096b04f7efd9e1041ee896229ec5a9b456ed33d0f
                                                                                                • Instruction ID: 7860283d6e186db2c24ad3ed4c4f1ebdb73ee85a9a225258b756bfae6b32a8fe
                                                                                                • Opcode Fuzzy Hash: 47ad13db34c0f2121cece03096b04f7efd9e1041ee896229ec5a9b456ed33d0f
                                                                                                • Instruction Fuzzy Hash: EFE0EC30951209EFCB94DFA8ED419AD77F5FB84308B1086ADD809E7211EA321E519B40
                                                                                                Function 05C23318 Relevance: .0, Instructions: 18COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 2690b790b85d28ffcecc5961d4966d71eb31cb5a83773149f4e2671d3c177a2e
                                                                                                • Instruction ID: 165dc8c7a59db7e3ad11aa0e2ff35bafe3ca646c9289447e1c767a106ff1a8d5
                                                                                                • Opcode Fuzzy Hash: 2690b790b85d28ffcecc5961d4966d71eb31cb5a83773149f4e2671d3c177a2e
                                                                                                • Instruction Fuzzy Hash: 1FE02E707042008FE720DB7CF084B693BE2AB8E318F840488E18ACF340DF28DD428B84
                                                                                                Function 05C46DD8 Relevance: .0, Instructions: 18COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: cf74e7c2ddf507be559716ef6fa1ffe9e676eb95f21e31114973f6cac3451afe
                                                                                                • Instruction ID: 9786a62a3e002cd8d2cadead31137b9c328b4b763c14edc34837a2e68e4cd9d7
                                                                                                • Opcode Fuzzy Hash: cf74e7c2ddf507be559716ef6fa1ffe9e676eb95f21e31114973f6cac3451afe
                                                                                                • Instruction Fuzzy Hash: 1FD05B363001189F87066BB0D409C8EFF95DF09250301847AF5058B121DE37D851EBC0
                                                                                                Function 05C41ABB Relevance: .0, Instructions: 17COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 06941de30f2db9936f22dc3a267d1d37e40583e03443f21c550274353297a695
                                                                                                • Instruction ID: cd75bf6c91bab4f8217e9dad71954981d6baee7bdd738b22f621a405bb5df934
                                                                                                • Opcode Fuzzy Hash: 06941de30f2db9936f22dc3a267d1d37e40583e03443f21c550274353297a695
                                                                                                • Instruction Fuzzy Hash: 44E012B090020DEBCB44DFE8E94165DBBB5FB45214B9049ACD809E3301EE315E409794
                                                                                                Function 016E0E80 Relevance: .0, Instructions: 16COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: fcf305d6e74b2ab0def5cf57706ac02435ab59bc95cf68d4999698e4ead33ae4
                                                                                                • Instruction ID: 3b8d09555786a3b712f77ec5cd1e2b1063534bf6589eac04e58db630c4bce8b9
                                                                                                • Opcode Fuzzy Hash: fcf305d6e74b2ab0def5cf57706ac02435ab59bc95cf68d4999698e4ead33ae4
                                                                                                • Instruction Fuzzy Hash: 6FD01730A00209EB8B54EFA9ED0055DBBF9EB84204F1045ACD808E3200EE312E509B91
                                                                                                Function 05C41AC0 Relevance: .0, Instructions: 16COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 80b5e824b637a038c979ad1d19993002d4e3006eb93191adb489144a4e48e6f1
                                                                                                • Instruction ID: 3f4226a76835a8d44c244165f253ee19cf33b0592e77d8f389f1224259c755fb
                                                                                                • Opcode Fuzzy Hash: 80b5e824b637a038c979ad1d19993002d4e3006eb93191adb489144a4e48e6f1
                                                                                                • Instruction Fuzzy Hash: C6D05B7090020DEFCB44DFE8E94165DBBF5FB45200B9049ACD408E3300EE311F409794
                                                                                                Function 05C224F0 Relevance: .0, Instructions: 15COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 4518d3984da37c35388d8f7295a9562ecf84e4b47e8104cc4e45bb4cb9a85159
                                                                                                • Instruction ID: aeba20f3b5f3c7c56bdfa03aceb1d8a415432698fcff325e3469186c37d27498
                                                                                                • Opcode Fuzzy Hash: 4518d3984da37c35388d8f7295a9562ecf84e4b47e8104cc4e45bb4cb9a85159
                                                                                                • Instruction Fuzzy Hash: 52D0C9747042608BC724DB2CE484D6937E6AF8D6243915999E646CF354DE64DE428A84
                                                                                                Function 05C2CF18 Relevance: .0, Instructions: 13COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: d9788903d4b5fb0aa7d208d1cf381ab4755824f9ba1aba7580604fff97cdcc29
                                                                                                • Instruction ID: 55bbd23cf365f76d0d02ad1271739b5cb3523b4f28424658e0f5efc3f1717cd9
                                                                                                • Opcode Fuzzy Hash: d9788903d4b5fb0aa7d208d1cf381ab4755824f9ba1aba7580604fff97cdcc29
                                                                                                • Instruction Fuzzy Hash: 70C08C31B0173887831936A8A0094DAB7DDDB89A6A300087EF84E87B00CE72AC42C7C4
                                                                                                Function 05C2FF28 Relevance: .0, Instructions: 12COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: f584ae9b43fc4c206cae6cf2446d8cf096b64e6916393963ef4266afdf302cee
                                                                                                • Instruction ID: ca4f5b3e5f75cb90e074a2ef4e3e57610b623fa0b1af6567b6ea71debb3094d5
                                                                                                • Opcode Fuzzy Hash: f584ae9b43fc4c206cae6cf2446d8cf096b64e6916393963ef4266afdf302cee
                                                                                                • Instruction Fuzzy Hash: D7C08C3828D30A33EA2946819C02F217A5CDB02602F000098FE0A541819983D0200295
                                                                                                Function 05C24340 Relevance: .0, Instructions: 11COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 7496a0249b6c3115370c7cda65574914b65ae19116a38e96be4d5de2c204e320
                                                                                                • Instruction ID: 12aa4e3e0a1c759542dd5a7cb1e581e7627a52832b17b3f51b871137df9a6e67
                                                                                                • Opcode Fuzzy Hash: 7496a0249b6c3115370c7cda65574914b65ae19116a38e96be4d5de2c204e320
                                                                                                • Instruction Fuzzy Hash: 81D012313041608BE240D76CF914B54B790EB46224F55DAAAD915C7392C772DC07C795
                                                                                                Function 05C21EB9 Relevance: .0, Instructions: 10COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 4480f5f3bdd84a671c5120a21971494c2647d7d07448d94a856c4c57677f56d6
                                                                                                • Instruction ID: 8e5808841fc872b8343ed0f8fe260e45e94870c81d08fc9d77fffb11cdcc35ae
                                                                                                • Opcode Fuzzy Hash: 4480f5f3bdd84a671c5120a21971494c2647d7d07448d94a856c4c57677f56d6
                                                                                                • Instruction Fuzzy Hash: 34D022B02043C09BFF23DBB8AD887043FD1F303220F04025AE441C0681C7A8A0A0C38A
                                                                                                Function 016ED510 Relevance: .0, Instructions: 9COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2142282413.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_16e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 919021aededb96d7b70641c70fa8aa727ce1dad0b4fa99dc46c776dfcdff8973
                                                                                                • Instruction ID: 5cab900b2993ccfb56e921abebeb347b2e3b017639e81257c93b6a0e1b219aad
                                                                                                • Opcode Fuzzy Hash: 919021aededb96d7b70641c70fa8aa727ce1dad0b4fa99dc46c776dfcdff8973
                                                                                                • Instruction Fuzzy Hash: 78B0927090930CAF8620DA99980185ABBACDA1A210B4001EAEA0887320D972A9109AE1
                                                                                                Function 05C400F6 Relevance: .0, Instructions: 9COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: d9c70aa9fd84296bdf8dd6892ca0417271922cac6b82a587f8362a684a2346ff
                                                                                                • Instruction ID: 8a5a3616e344925268adddbef36ac06fcf4b5f12e113b1e62f962da56c40e5ad
                                                                                                • Opcode Fuzzy Hash: d9c70aa9fd84296bdf8dd6892ca0417271922cac6b82a587f8362a684a2346ff
                                                                                                • Instruction Fuzzy Hash: 1BC04C36A000098B8F10DAC5F4455DCF771EB8422AB144162D515621108A312957CB80
                                                                                                Function 05C24F58 Relevance: .0, Instructions: 8COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 5b45efd77e68d11a95b2fdfb2cc8cd8ffb94ceaeaa58f4e44f109c115214e4bc
                                                                                                • Instruction ID: e47d30702f1745433ca8f59f7749c8c715a6ba0887bf38f90e7ee068f8e27a82
                                                                                                • Opcode Fuzzy Hash: 5b45efd77e68d11a95b2fdfb2cc8cd8ffb94ceaeaa58f4e44f109c115214e4bc
                                                                                                • Instruction Fuzzy Hash: 3DC08C62E04201CBFE41C318C500B6073A063912A0F0D939490048AB92D32E88008B01
                                                                                                Function 05C24F90 Relevance: .0, Instructions: 7COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 322657e61e9c6ce5b83a50ebd88147d3da5890114ddfd7d4cd041c42ac10d703
                                                                                                • Instruction ID: 977073d67c4b3ef17b97f00b976dee3f8478b05c94b80ba82d4da0bf4004d4bb
                                                                                                • Opcode Fuzzy Hash: 322657e61e9c6ce5b83a50ebd88147d3da5890114ddfd7d4cd041c42ac10d703
                                                                                                • Instruction Fuzzy Hash: D3B0123100030F9BD78067D9F4056043F2CE5C0204744D214B10D45505DDAE2C404BDC
                                                                                                Function 05C41DB0 Relevance: .0, Instructions: 7COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 47b79ab20293e8777704b5f199728ff4ad94c1b7c5da8e23356f30e8df4ff6b5
                                                                                                • Instruction ID: eead1b1c976a9ff2cbc7542f39ae37b19446c8fb68ada12ee2986917e4b0d41d
                                                                                                • Opcode Fuzzy Hash: 47b79ab20293e8777704b5f199728ff4ad94c1b7c5da8e23356f30e8df4ff6b5
                                                                                                • Instruction Fuzzy Hash: C6C04872408244ABC310DA64DA8AB4AB771AB90304F25C5A4AA049A355DA71CC2ACBDE
                                                                                                Function 05C481D9 Relevance: .0, Instructions: 6COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 19d1a6e9555b56368d2ce18e068ea6658b87eff1791477cebefca2d46455f657
                                                                                                • Instruction ID: a19a9752924b329a7b2b7ce0d98e980f729e597ee5d454b6de5f4706c2a8202b
                                                                                                • Opcode Fuzzy Hash: 19d1a6e9555b56368d2ce18e068ea6658b87eff1791477cebefca2d46455f657
                                                                                                • Instruction Fuzzy Hash: 32B01279200200CFE3046B30C044948B6B6EB531443D8C89CC80089240C73BC443DB40
                                                                                                Function 05C22E60 Relevance: .0, Instructions: 5COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 90914831e188827bec8fb6699bd0399d0e9162b9d4fb3fdc093ca0e1bd9b8edc
                                                                                                • Instruction ID: e413b76829ce511345703c63ff0569b35dd3d5bbca212faf01176842e92940fb
                                                                                                • Opcode Fuzzy Hash: 90914831e188827bec8fb6699bd0399d0e9162b9d4fb3fdc093ca0e1bd9b8edc
                                                                                                • Instruction Fuzzy Hash: 3BB011302000008B8288CA08C880808F3A2ABE8308328C0AEA808CB20ACF33E803CA08
                                                                                                Function 05C41C1B Relevance: .0, Instructions: 4COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 97644d3e8fb3eade74de839b28f71bfd9ca9694798f2dd49bce2c0da3016e84b
                                                                                                • Instruction ID: 0b0e28a9538a3b3a9799a01eef670788e19aab13e05293acd7dd0605b5576b01
                                                                                                • Opcode Fuzzy Hash: 97644d3e8fb3eade74de839b28f71bfd9ca9694798f2dd49bce2c0da3016e84b
                                                                                                • Instruction Fuzzy Hash: 1AA002A579024087CE0997A0A69AB282B22B6C22613C94D64F443C5244CD65C8C0DA88

                                                                                                Non-executed Functions

                                                                                                Function 05C4039B Relevance: .5, Instructions: 542COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155408467.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: d73b9649cd8d491b0118ed8177b283ea0eb71b6baf66f13751138fffaf3540a1
                                                                                                • Instruction ID: e92f1ebb8e44753666bf09677ba85a9f614336a4b79acf23dd1bcf8027022d90
                                                                                                • Opcode Fuzzy Hash: d73b9649cd8d491b0118ed8177b283ea0eb71b6baf66f13751138fffaf3540a1
                                                                                                • Instruction Fuzzy Hash: F9222934B01214CFDB19DB78C958A5DB7F2EF89215F1489A8E50AAB3A1DB35DD82CF40
                                                                                                Function 05C260C0 Relevance: .4, Instructions: 372COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.2155285438.0000000005C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_5c20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 13d9457a572fcc908d5a51c6231a40c8d86b8fa50463f4c19a2b8d0b3a6b71de
                                                                                                • Instruction ID: 719f3135c43d4282a0a255f1dee2c9e68449dd290ad8268b2bd9bcb90f9698d2
                                                                                                • Opcode Fuzzy Hash: 13d9457a572fcc908d5a51c6231a40c8d86b8fa50463f4c19a2b8d0b3a6b71de
                                                                                                • Instruction Fuzzy Hash: 4CE17231E1065A9FCF05DFA8C8405DEFBB1FF99310F15865AD415BB210EB74A986CB90

                                                                                                Executed Functions

                                                                                                Function 05116DE8 Relevance: .3, Instructions: 312COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 14ff9775e8aef40fdfa1b7e1f99ae5f236639b8367fe8b088de7e67a777eb18d
                                                                                                • Instruction ID: c18d1049256f94649a1eb24966057e9be53498383c1532ed3e41fea7735d898b
                                                                                                • Opcode Fuzzy Hash: 14ff9775e8aef40fdfa1b7e1f99ae5f236639b8367fe8b088de7e67a777eb18d
                                                                                                • Instruction Fuzzy Hash: 62B1E03290E3E09FD703DB78D8646DA7F71AF47210F0A41CBD0919F1A3DA694949CBA6
                                                                                                Function 05116508 Relevance: .2, Instructions: 238COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 9c486836a4af7eb4cd586309011f4c4bb53653e9af41bc13784c86de99c71bee
                                                                                                • Instruction ID: e1c0f915537cc9412ad343d713ad2a7a8a620e15a02c54c930e3824a98c2f922
                                                                                                • Opcode Fuzzy Hash: 9c486836a4af7eb4cd586309011f4c4bb53653e9af41bc13784c86de99c71bee
                                                                                                • Instruction Fuzzy Hash: B181F234B112159FCB24DB65D868BAEBBB2BF84700F1081BDE8069B694DF369C45CB84
                                                                                                Function 05116255 Relevance: .2, Instructions: 238COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: d9ff1371766195995b4ad00a4e9d8406e6fdce3c670ead6f0734c49c198952b2
                                                                                                • Instruction ID: 423eb4c45c2008c3589c6d60b0ffc3e952074a9ce65b7b42a5058a44e63f91f4
                                                                                                • Opcode Fuzzy Hash: d9ff1371766195995b4ad00a4e9d8406e6fdce3c670ead6f0734c49c198952b2
                                                                                                • Instruction Fuzzy Hash: 4B812731B093549FC702DB68D8909EA7FF2EF4A210F0540EBE845DB662C7359D05CBA9
                                                                                                Function 051129C8 Relevance: .2, Instructions: 228COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 4ccf687289b9bbc9ebf257845c1d3209c31beb6f182d5018b872ed9245a4f359
                                                                                                • Instruction ID: d261ef2e7234646a1328548db85ff8a926f097f31c75e8081e14bc1179d3449e
                                                                                                • Opcode Fuzzy Hash: 4ccf687289b9bbc9ebf257845c1d3209c31beb6f182d5018b872ed9245a4f359
                                                                                                • Instruction Fuzzy Hash: CA915C35A10605CFCB04DF79D8909ADB7B2FF88310B148669E959AB314EF74ED81CB94
                                                                                                Function 05111080 Relevance: .2, Instructions: 212COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: b740d12152cbc80b345eb7c10396a5040ae7db10b86e0d88829b7ff44677d707
                                                                                                • Instruction ID: 0fc99495138864de78a2ae24612c3baaa6fc59fe1cd1f52c3e35384dea9bf9ee
                                                                                                • Opcode Fuzzy Hash: b740d12152cbc80b345eb7c10396a5040ae7db10b86e0d88829b7ff44677d707
                                                                                                • Instruction Fuzzy Hash: 8971B235B10204AFDB18EBB5C854A7EBAA7BFC8210F148079DA069B3A4DF749D42C754
                                                                                                Function 051129A0 Relevance: .2, Instructions: 166COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 455307857236cef422ea85360a19a364e0cee6ddcb32d3ac18853968d57d0f38
                                                                                                • Instruction ID: cd71e7ebe4a89903657dea9151e200f03cce89a1d2c80bf9d003076e534fc51a
                                                                                                • Opcode Fuzzy Hash: 455307857236cef422ea85360a19a364e0cee6ddcb32d3ac18853968d57d0f38
                                                                                                • Instruction Fuzzy Hash: E951BD397102008FCB05DF3AD890A6A7BF2EF8862071481AAD955DF365DF78ED42CB95
                                                                                                Function 05111630 Relevance: .2, Instructions: 156COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: aa17198adfddb26181291b2f330d82cfaf49c92bff30ef8fe981f896f5640800
                                                                                                • Instruction ID: 9752bacd97d719b5acc376374806f0fa30b5d333ce1a20aa15d0418d9bae33d8
                                                                                                • Opcode Fuzzy Hash: aa17198adfddb26181291b2f330d82cfaf49c92bff30ef8fe981f896f5640800
                                                                                                • Instruction Fuzzy Hash: 3D51F235B012499FCB15EF78C8446AEBBF6BFC9250B1481BADA05D7355DB308D42CBA4
                                                                                                Function 051128B4 Relevance: .1, Instructions: 141COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: adeff693516ac95a27dd3f300ae3922207763f41204ee33cc9f51ae0137d85cf
                                                                                                • Instruction ID: 4eaf27f03ab9cc075dee3335f59e9d6f9f1ff4793cd4ed5f39dbc2b995f68511
                                                                                                • Opcode Fuzzy Hash: adeff693516ac95a27dd3f300ae3922207763f41204ee33cc9f51ae0137d85cf
                                                                                                • Instruction Fuzzy Hash: DB410339B11215AFDF089A76D864B7E3AA7FBC5600F0444B9E816DB385EF388D418399
                                                                                                Function 05116F78 Relevance: .1, Instructions: 138COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 91a2802ded9d0daf7582dc1f4e1658a80a458eec7123eec375ac93d9312e36e1
                                                                                                • Instruction ID: 08e1e283246b9857edfd4f86287b3c9f2dac1508a5cd7f8ce122478e7f0e2b7e
                                                                                                • Opcode Fuzzy Hash: 91a2802ded9d0daf7582dc1f4e1658a80a458eec7123eec375ac93d9312e36e1
                                                                                                • Instruction Fuzzy Hash: 4D518C34E10249DFDB05DFB8D854BDDBBB2FF88300F109559E615AB281DB78A985CBA0
                                                                                                Function 051150BF Relevance: .1, Instructions: 109COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: f7c30b76f862118d9bf92d1f3536c700892014d7d2345a94166f29e1020e055a
                                                                                                • Instruction ID: 74bea61d95bf022199c7383e7e54db879bf57a064140a5e982c72076b5071d8f
                                                                                                • Opcode Fuzzy Hash: f7c30b76f862118d9bf92d1f3536c700892014d7d2345a94166f29e1020e055a
                                                                                                • Instruction Fuzzy Hash: A3419134A14214DFDB16DB74D894AAE7BB3BFC8310F15807AD802AB355DB749841CF94
                                                                                                Function 05112268 Relevance: .1, Instructions: 106COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 4cd02c6e46653ae90bd8da3afb8b9d64f6a2e24bb908ab938d80e34f0e0eca1a
                                                                                                • Instruction ID: dcdc538baa45901d80e2e239310d9035011e60168d958914846a46cca48f1d58
                                                                                                • Opcode Fuzzy Hash: 4cd02c6e46653ae90bd8da3afb8b9d64f6a2e24bb908ab938d80e34f0e0eca1a
                                                                                                • Instruction Fuzzy Hash: 2541F539B102189FCB54DF69D88499EBBB6FF8D310B1081AAE915EB360DB31DD41CB94
                                                                                                Function 05110C1C Relevance: .1, Instructions: 99COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 8b064ee830936f7dd21e35bcf80ce66abc1c67a04a7d82943eb6afb9b2887a07
                                                                                                • Instruction ID: b327b64d8c0681845727d9684b8b56642e0677d072bdff83e2cdbaa88fb62689
                                                                                                • Opcode Fuzzy Hash: 8b064ee830936f7dd21e35bcf80ce66abc1c67a04a7d82943eb6afb9b2887a07
                                                                                                • Instruction Fuzzy Hash: 0531E930B443485BD719A779986477E7EB3ABC6200F1484BAD942EB382CF784C05C399
                                                                                                Function 051150D0 Relevance: .1, Instructions: 98COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: f11dd11c0af3aaa874763c5170a1fe44f4f136f582f256aaa7c00cb437f60438
                                                                                                • Instruction ID: e7c5f0787c44b1932aef641778ee48c14a6ed6502478acf9678d579b68746d37
                                                                                                • Opcode Fuzzy Hash: f11dd11c0af3aaa874763c5170a1fe44f4f136f582f256aaa7c00cb437f60438
                                                                                                • Instruction Fuzzy Hash: AA314D34A14218DFEB15DB75D858AAE7BB3BFC8310F15807AD802AB395DF749841CBA4
                                                                                                Function 051163A0 Relevance: .1, Instructions: 91COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 25be66206f351144c2e033d879482ae91f669c50b52728cd57a46d6149e16d1f
                                                                                                • Instruction ID: ce9567d3a9fe9837b722c6ebc9d5a3ed19200b733e9df7e666b30e6470622d70
                                                                                                • Opcode Fuzzy Hash: 25be66206f351144c2e033d879482ae91f669c50b52728cd57a46d6149e16d1f
                                                                                                • Instruction Fuzzy Hash: 5B31E778A10118DFCB04DFA9D48499DBBF6FF88310B1580A9E905E7725DB35EC41CB94
                                                                                                Function 05112D60 Relevance: .1, Instructions: 89COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 73ea5d01e2a167861ca5332a8df92e2205dd48f1cf70003c64ccd172187ac46b
                                                                                                • Instruction ID: 377efcf52decb4a2420c2a3d3bbcbb2fe7e0aff38f8dbc7ad12ac10d75e20ca0
                                                                                                • Opcode Fuzzy Hash: 73ea5d01e2a167861ca5332a8df92e2205dd48f1cf70003c64ccd172187ac46b
                                                                                                • Instruction Fuzzy Hash: 1721E039B012556BDF08DA2ADC59B7F3AEBFB84640F0440BCE826D7284EF34C9418798
                                                                                                Function 051128C4 Relevance: .1, Instructions: 89COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: c92bc37c7c35272ed9434a4f2e268b9231d6282bc461044e439faa7471136dbb
                                                                                                • Instruction ID: d76408dc0964165a322ccc6622f9bf61219488ae4e3fbd38bb3db39e39be0920
                                                                                                • Opcode Fuzzy Hash: c92bc37c7c35272ed9434a4f2e268b9231d6282bc461044e439faa7471136dbb
                                                                                                • Instruction Fuzzy Hash: 972148357093405FD7196A35A8A8BBE6FA7ABC5650F0480BAED45D7281CF384902C369
                                                                                                Function 051128E4 Relevance: .1, Instructions: 87COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 8d253f364425a1abca2b6843df07bb0f544b79692102ee6a72a17f40875f3372
                                                                                                • Instruction ID: 5bbb0db0853f95b8f75b465efa9f91b46db7894f768f6a76829c4b0ef85e43b5
                                                                                                • Opcode Fuzzy Hash: 8d253f364425a1abca2b6843df07bb0f544b79692102ee6a72a17f40875f3372
                                                                                                • Instruction Fuzzy Hash: 10217F367093997FDB0622756818BBB7F559F02120F0585F7FE988A193CB388845D3D9
                                                                                                Function 05119360 Relevance: .1, Instructions: 86COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 8ca04748299d7459f0cbf60f6ef5ad6b70e2a471800ed973047f6a7f90cde729
                                                                                                • Instruction ID: 88ded943ba1be2a13624060e868b203423a8f68c2a345a3182a12ba51388d067
                                                                                                • Opcode Fuzzy Hash: 8ca04748299d7459f0cbf60f6ef5ad6b70e2a471800ed973047f6a7f90cde729
                                                                                                • Instruction Fuzzy Hash: 8A21463670E3801FD716563168A4BBF2FA7ABC5910B0880FBEC55C7282CB384946C369
                                                                                                Function 05118A30 Relevance: .1, Instructions: 83COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: e2f97c58503dc466db3cf195553e66d188b105c835c0e864e58cbab9192ee1f9
                                                                                                • Instruction ID: 54213f24922521b0ab97443861a601a5124b29364974bf53a587e0eb6b122322
                                                                                                • Opcode Fuzzy Hash: e2f97c58503dc466db3cf195553e66d188b105c835c0e864e58cbab9192ee1f9
                                                                                                • Instruction Fuzzy Hash: 0921A535B05205ABDB18DB61E8997FE7BB7BB88700F10C029E802A7380DF755D06CB98
                                                                                                Function 05118A40 Relevance: .1, Instructions: 78COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 0697c03d29cedfffa6ad828820f7e33ec360ce04967f63d80005bb7f90f132ce
                                                                                                • Instruction ID: da617431c46f9d8a967bd02604c1e8a321660e25a652cad92ba76c0a43a3bcdb
                                                                                                • Opcode Fuzzy Hash: 0697c03d29cedfffa6ad828820f7e33ec360ce04967f63d80005bb7f90f132ce
                                                                                                • Instruction Fuzzy Hash: 90218534B11205ABDB18DB61E5997AEBBB7BB88700F10C029E803A7384DF755D06CB98
                                                                                                Function 051128D4 Relevance: .1, Instructions: 66COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 9e4cad473e8992f98764969eeac16f0ea8392b654c29e9b7ed9e6a3a8ba455f2
                                                                                                • Instruction ID: bb36a705af7d5b768648c2325553cb5e497f7698621aa28d51b82874981833ed
                                                                                                • Opcode Fuzzy Hash: 9e4cad473e8992f98764969eeac16f0ea8392b654c29e9b7ed9e6a3a8ba455f2
                                                                                                • Instruction Fuzzy Hash: 77110A297157651BDB18267AAC54B7E2EDB9B82600F0444FAEC51C7383DEBC8C0103AA
                                                                                                Function 05119461 Relevance: .1, Instructions: 64COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 017126ad26f810eec565fd46c17a55dc63681f57be1bc1bb76eb65b2fc316e62
                                                                                                • Instruction ID: b5a450c13fdccef71ea234deb19e336c90c179456a9d6b684297ecfbd7e9313b
                                                                                                • Opcode Fuzzy Hash: 017126ad26f810eec565fd46c17a55dc63681f57be1bc1bb76eb65b2fc316e62
                                                                                                • Instruction Fuzzy Hash: 7F219035B40214BFDB05DB64E855ABDBBB7EF8C321F004069E949A7381CF395846DBA4
                                                                                                Function 05113070 Relevance: .1, Instructions: 63COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: d4f0fe57269f4c69d0c693d86f623b9fa4a3da953f7888dcb2a81472d2b13a55
                                                                                                • Instruction ID: a753deac8338c86d616344a6a277daba843f5e5c6d0ba144e14fdf4e1b959580
                                                                                                • Opcode Fuzzy Hash: d4f0fe57269f4c69d0c693d86f623b9fa4a3da953f7888dcb2a81472d2b13a55
                                                                                                • Instruction Fuzzy Hash: 2021D130B00215ABCB09DB64E854AAEBFF3AF8C311F048468EC45A7385CF399846DB94
                                                                                                Function 05110F20 Relevance: .1, Instructions: 62COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 8e8dfbf47cf8a944e84a23b5c94d3f05ee94c88d5e840d5df1a4ff3c595567eb
                                                                                                • Instruction ID: 19625f8b31682826e9e47653cc29ffd8f2a9f8d5728999ac9ddf50b268261ae7
                                                                                                • Opcode Fuzzy Hash: 8e8dfbf47cf8a944e84a23b5c94d3f05ee94c88d5e840d5df1a4ff3c595567eb
                                                                                                • Instruction Fuzzy Hash: BB016B35B4936037C71526795898B3EBB5A9BC6510F0108F6EE44C7302DF688D01C2A9
                                                                                                Function 05112258 Relevance: .1, Instructions: 60COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: d316fc3f607ecf2640d68de18d859a3c1505aafbec91b21543b7a6f0f60884da
                                                                                                • Instruction ID: 1aeaf8b720c6ed1fc93756920b5b1ee045df92b464d23afc47617e6025b62296
                                                                                                • Opcode Fuzzy Hash: d316fc3f607ecf2640d68de18d859a3c1505aafbec91b21543b7a6f0f60884da
                                                                                                • Instruction Fuzzy Hash: BD216735E102089FCB44DFB9D88499EBBF2FF8C310B10816AE805AB320DB319981CF94
                                                                                                Function 05113080 Relevance: .1, Instructions: 59COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 5da2403b957d3fe6529e82e504cb5cf9044978833b0fa91c5e1f66e04b9c0e4c
                                                                                                • Instruction ID: a32a0ddf858bbb7dcaa39f6188c6ce17f79cde8beff495c3806d703b27180c52
                                                                                                • Opcode Fuzzy Hash: 5da2403b957d3fe6529e82e504cb5cf9044978833b0fa91c5e1f66e04b9c0e4c
                                                                                                • Instruction Fuzzy Hash: 39118430B40215AFDB09DB64E854EAEBFB3AFCC310F148424E945A7385CF799846DB94
                                                                                                Function 05110F30 Relevance: .1, Instructions: 59COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 897f4195686bc527a888bcef8987cacfdcd0c3424e30d237051b588d1193a381
                                                                                                • Instruction ID: 07c64451cfd4e31dc2a17895d31ed7d4a7d4d184b1574215c92f014a0f8e7516
                                                                                                • Opcode Fuzzy Hash: 897f4195686bc527a888bcef8987cacfdcd0c3424e30d237051b588d1193a381
                                                                                                • Instruction Fuzzy Hash: A501892175D3881FCB06A7B4A81177DBF76AB81400F084DEAE98ACB302CF08C906C3D9
                                                                                                Function 05119470 Relevance: .1, Instructions: 57COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: a374b084bed6263baa09eb7705d9db17509f7a66c8bbb7e222ab5de67b8f79ee
                                                                                                • Instruction ID: fbfbfd1864b7930831bcfc7784eb2e9934942817a9176a17139ffe012d3ffeef
                                                                                                • Opcode Fuzzy Hash: a374b084bed6263baa09eb7705d9db17509f7a66c8bbb7e222ab5de67b8f79ee
                                                                                                • Instruction Fuzzy Hash: 93118130B40214BFDB09DB64E855EADBBB7AF8C310F104069E909A7381CF796846DBA4
                                                                                                Function 05111378 Relevance: .1, Instructions: 56COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: afc208ba1837f7d80da40c46ba63df0bb99c402311f302bfc738c28930a344c9
                                                                                                • Instruction ID: cdf7df2f95dafb3fb21363a72136ed3d9c030bb412de7d4cc40fa849a9f92544
                                                                                                • Opcode Fuzzy Hash: afc208ba1837f7d80da40c46ba63df0bb99c402311f302bfc738c28930a344c9
                                                                                                • Instruction Fuzzy Hash: 3D2134719042099FDB10DFAAC481AEEFBB0FF88324F148429D519A7200CB796941CFA5
                                                                                                Function 05112CD0 Relevance: .1, Instructions: 55COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 21e2a7f15f2444aa938c19ee3b00cbd3fc1d159370eec4c94ef5b87f83f5e92f
                                                                                                • Instruction ID: 433058360bece3d97299d670124892152651ec778f235256a084da8992f58d06
                                                                                                • Opcode Fuzzy Hash: 21e2a7f15f2444aa938c19ee3b00cbd3fc1d159370eec4c94ef5b87f83f5e92f
                                                                                                • Instruction Fuzzy Hash: C601043AF001188BCF188AAAD8107EEB7F2FF8C351F0440BAC905B3244DB399841C7A8
                                                                                                Function 05118058 Relevance: .1, Instructions: 53COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 18324bb59bb8f1c258d3cd749b53f7b5c46428d4a09b33d21b35533249fccf78
                                                                                                • Instruction ID: be59268b2e2001af2545e386f89a2c47a3ee187333f159b75930ca3e2db47f35
                                                                                                • Opcode Fuzzy Hash: 18324bb59bb8f1c258d3cd749b53f7b5c46428d4a09b33d21b35533249fccf78
                                                                                                • Instruction Fuzzy Hash: 9D017C3A301110AF8708DA6EF49486AB3ABFBC8665314807AE605C7310CA32DD0287A8
                                                                                                Function 05111380 Relevance: .1, Instructions: 53COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 629be1b7c113fa4a6cf5442a5bcd913e920e64604432c926761e56c18d2b87c4
                                                                                                • Instruction ID: 028fcfac201aa5f9d16bfea55c34a7287ead3189318c5b391c65a4cfa3692c4f
                                                                                                • Opcode Fuzzy Hash: 629be1b7c113fa4a6cf5442a5bcd913e920e64604432c926761e56c18d2b87c4
                                                                                                • Instruction Fuzzy Hash: 5911E371D042499FDB10DFAAC481AAEFBB4FF88624F10842AD91967240CB796945CFA5
                                                                                                Function 05111968 Relevance: .1, Instructions: 51COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 27951ef84ee6d63aeb37a7536b1c6dbab756b7cc7a5b431d6e39c3f52670fa57
                                                                                                • Instruction ID: 421eb83c708d38bbd6afc1d504a4080a4107773f8dbf01f2cea0420e3e51b88c
                                                                                                • Opcode Fuzzy Hash: 27951ef84ee6d63aeb37a7536b1c6dbab756b7cc7a5b431d6e39c3f52670fa57
                                                                                                • Instruction Fuzzy Hash: EE113031A10214AFDB05DB64E855EBD7FB7EF8C314F144029E949A7340CF795846DBA0
                                                                                                Function 05112CC2 Relevance: .0, Instructions: 50COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: fac1724f374b74b56978f7409ce831b1be90e2d26d47688348ac31101abcefcf
                                                                                                • Instruction ID: 16671ae83980b020306a2f9feb1a8ca9b3065359e384845650f791d4d5a626b4
                                                                                                • Opcode Fuzzy Hash: fac1724f374b74b56978f7409ce831b1be90e2d26d47688348ac31101abcefcf
                                                                                                • Instruction Fuzzy Hash: 2301B53AF051589BDF188A6AD8147EEB6F7AF88350F0440B9D815B7244DB39990087A9
                                                                                                Function 05116A21 Relevance: .0, Instructions: 47COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: cab899ca09dc1cff9e61fa9534eb8d6d04f79227dc2ff80e841f323418da5ed8
                                                                                                • Instruction ID: 4c3c5c20d3a2ede24efea0529ec2d3fc1316025b6af5a4cdaecf44b3a3c52cd3
                                                                                                • Opcode Fuzzy Hash: cab899ca09dc1cff9e61fa9534eb8d6d04f79227dc2ff80e841f323418da5ed8
                                                                                                • Instruction Fuzzy Hash: ED01F9317051048BCB14EA69C4587EF7AF39FC8200F2484BED406A7394CF754D4587C9
                                                                                                Function 034CD01D Relevance: .0, Instructions: 45COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000002.2155632756.00000000034CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 034CD000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_2_34cd000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: afbd4b3289288528188d208942f55fcae8a3da136eb63f20613cabe50a9d5b31
                                                                                                • Instruction ID: af095de2c0b70141c4749214b58c20fbe2a74240db301ac222f12052b3c66b92
                                                                                                • Opcode Fuzzy Hash: afbd4b3289288528188d208942f55fcae8a3da136eb63f20613cabe50a9d5b31
                                                                                                • Instruction Fuzzy Hash: 3B01F7758043809AE7508A2ACD84B67FF98DF42368F0CC07FDD181E242C6B99442C6B5
                                                                                                Function 034CD006 Relevance: .0, Instructions: 45COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000002.2155632756.00000000034CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 034CD000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_2_34cd000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 8fabdf24edac75d9f5dc0347d2399ba92cabd926b7e3890566ad6131663652b8
                                                                                                • Instruction ID: 5f957f886978c9a056c9c682fb13faa5800e04de70c0f1863e5be3679b27f97a
                                                                                                • Opcode Fuzzy Hash: 8fabdf24edac75d9f5dc0347d2399ba92cabd926b7e3890566ad6131663652b8
                                                                                                • Instruction Fuzzy Hash: 7701ED6140E3C09FE7528B258D94B52BFB4DF53228F1D81DBD9888F2A3C2695849C772
                                                                                                Function 05116A30 Relevance: .0, Instructions: 45COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 364ff42cdb619fd675adee7a2baa8f75d74e420f3fe0ffe7bd4ddeeef7676d3d
                                                                                                • Instruction ID: 6294cd848baf013e6fe3c29160f5bffa64af0b1c0c54dc4ec512682a192708ff
                                                                                                • Opcode Fuzzy Hash: 364ff42cdb619fd675adee7a2baa8f75d74e420f3fe0ffe7bd4ddeeef7676d3d
                                                                                                • Instruction Fuzzy Hash: 7F01A731B041088BDB18EA6AC4587AF7AF79FC8200F2484BDD506A7790CF754D4687D9
                                                                                                Function 0511182B Relevance: .0, Instructions: 44COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: f06fa77aea24e4c577906964e6b285e6dc9ca80c430cd97e67456b6c2bcbbba8
                                                                                                • Instruction ID: 1529488fcee6f7153e2c161dc223954a99a003cd793285a59983ecd1f3bf12fd
                                                                                                • Opcode Fuzzy Hash: f06fa77aea24e4c577906964e6b285e6dc9ca80c430cd97e67456b6c2bcbbba8
                                                                                                • Instruction Fuzzy Hash: 8B01A231B00108A7DB18A669C8597AF7AB7ABCC700F1584B99902B3381CF754C01C7D9
                                                                                                Function 05117FD0 Relevance: .0, Instructions: 43COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 36f5e834532a56042fc8e5f3e54fd53e7d6baa710a0a4fd0e07bbd367960e51f
                                                                                                • Instruction ID: 139e425e9367f66892267166076021c603b0de8f92a9023efdf6134fcd2e1a60
                                                                                                • Opcode Fuzzy Hash: 36f5e834532a56042fc8e5f3e54fd53e7d6baa710a0a4fd0e07bbd367960e51f
                                                                                                • Instruction Fuzzy Hash: E2F0F6723052415FD7139A2EEC908DBBFAAFEC5664300866FE905CB351DFA18D0543E8
                                                                                                Function 05111440 Relevance: .0, Instructions: 39COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: bca93d2502a26188558689690ab4bcde7fe3f107d52c0c7636e810d08b05a008
                                                                                                • Instruction ID: 84807d1b2d538ba7557ffb5be0ae6da5acc08a229bbfe40c8f9d94220bdee906
                                                                                                • Opcode Fuzzy Hash: bca93d2502a26188558689690ab4bcde7fe3f107d52c0c7636e810d08b05a008
                                                                                                • Instruction Fuzzy Hash: 3E01D631A193456FD70A5B74B861A2D3FA6AFC160070418F9DA46CF250EF648805C790
                                                                                                Function 05111BB0 Relevance: .0, Instructions: 36COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: b113c4727619bcfb8fce790e479de8ce81580b7260a7f71fe1caa3ccb775991a
                                                                                                • Instruction ID: 5d35c8d98ae2183757f090387fcac829dbb6392404143bb29666903edf1ad895
                                                                                                • Opcode Fuzzy Hash: b113c4727619bcfb8fce790e479de8ce81580b7260a7f71fe1caa3ccb775991a
                                                                                                • Instruction Fuzzy Hash: A7F0E935B4535137C72596666484B3FAF5B7BC5560F1400B9EF4587201EB24C941C2E8
                                                                                                Function 0511804A Relevance: .0, Instructions: 35COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 494510568e7dbebe92d2adc8df600020352b2f0cc2c01ee4ece59e0851e33365
                                                                                                • Instruction ID: 028066469982a1f9068a5009f374e6b37ce6d414b8de2c32b032f3ea0ff99a2c
                                                                                                • Opcode Fuzzy Hash: 494510568e7dbebe92d2adc8df600020352b2f0cc2c01ee4ece59e0851e33365
                                                                                                • Instruction Fuzzy Hash: 9CE0E53230D3407BD312526DBC449D3BFAEEBCA57970400ABF649C2202CBA5980483B4
                                                                                                Function 05115278 Relevance: .0, Instructions: 34COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 0375e52b11e5f36f558fe4d83f77a1feaafcd5bbfa610d946171074d384dc083
                                                                                                • Instruction ID: 4e759cab82d8b42154611e52dc816f6a153f44d2edf7041dcd6bbd222d3f8950
                                                                                                • Opcode Fuzzy Hash: 0375e52b11e5f36f558fe4d83f77a1feaafcd5bbfa610d946171074d384dc083
                                                                                                • Instruction Fuzzy Hash: D5F0A7367093806FD3019A3AEC50AD6BBAAEFC6225B54407AD108C7256CD359C46C7A1
                                                                                                Function 05117FE0 Relevance: .0, Instructions: 34COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 216a10af9a94480a0d7da4670f14fe83e845bbf8943a06103cd83478a2b1d7ed
                                                                                                • Instruction ID: f6b37242a4595a2cfbab95cfd3a28bea61a58501a6d70c2e751dc447fdadefc3
                                                                                                • Opcode Fuzzy Hash: 216a10af9a94480a0d7da4670f14fe83e845bbf8943a06103cd83478a2b1d7ed
                                                                                                • Instruction Fuzzy Hash: CAF0A7713002015B8716DB6EE88099BBBDBEFC9664300C53EEA09CB344DFB19C0547E8
                                                                                                Function 05111431 Relevance: .0, Instructions: 32COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 9604ee1927ddd0608acc1951d0a1aaba00ee4480f1c34367954605a517653d80
                                                                                                • Instruction ID: 324b7a0de074fd59315dab5c74ac11805b74e8d61bc4e609075c3f458a631b2b
                                                                                                • Opcode Fuzzy Hash: 9604ee1927ddd0608acc1951d0a1aaba00ee4480f1c34367954605a517653d80
                                                                                                • Instruction Fuzzy Hash: 97F09635A153456ED70D9BB4B812A3E7F9BABC164070418BD9A478F250EF648401CBD0
                                                                                                Function 05112EF8 Relevance: .0, Instructions: 30COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: d6caa37d43d59020417aa1545b24ce13f00c7cff86e8d9d4f24cf4caa9d944b8
                                                                                                • Instruction ID: 5a401d51f2cfe53e02a58fcca53aa7d66f4ea33643b9ddcd3418a7c69ea1f4a6
                                                                                                • Opcode Fuzzy Hash: d6caa37d43d59020417aa1545b24ce13f00c7cff86e8d9d4f24cf4caa9d944b8
                                                                                                • Instruction Fuzzy Hash: 2AE0922571066913EF28256ADC807B72ACE9B52614F0400FADC65D7B83EBF8DC4613EA
                                                                                                Function 05117F68 Relevance: .0, Instructions: 27COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 7b5fc069b4270c39095b4c060645626e05e63150602fde2db0df608020b8f386
                                                                                                • Instruction ID: 62ee2d99e56e90d84f657e73a2d8ff5177416d107910c12a04d7afdf74b97a3d
                                                                                                • Opcode Fuzzy Hash: 7b5fc069b4270c39095b4c060645626e05e63150602fde2db0df608020b8f386
                                                                                                • Instruction Fuzzy Hash: 97E092B5506248AFCB02CB74FC614DA7FB8EB46114B10499AE404E7101EA351F4487B2
                                                                                                Function 05115288 Relevance: .0, Instructions: 25COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 1c9e4906ceff970fb884aa0f1002663f9c1e7f27915c1fd3a2971c22af159c68
                                                                                                • Instruction ID: 2f1b9791070498db32290d0f18dd12055a7648b80dc932b579f3e9dc7f0e23ba
                                                                                                • Opcode Fuzzy Hash: 1c9e4906ceff970fb884aa0f1002663f9c1e7f27915c1fd3a2971c22af159c68
                                                                                                • Instruction Fuzzy Hash: E4E026367012005BD3049A2BE840957B3AFEBC9224B10403DD10CC7305CD329C4286A0
                                                                                                Function 05112959 Relevance: .0, Instructions: 21COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 013cb4d3aaa5611258a45ba611aff28aece1465f3e9f824a84b7c14f35ae2c70
                                                                                                • Instruction ID: 93d168fd226cd77c50b9868ce073f55ac7c3d159479fb1f90777936ac9fedeaf
                                                                                                • Opcode Fuzzy Hash: 013cb4d3aaa5611258a45ba611aff28aece1465f3e9f824a84b7c14f35ae2c70
                                                                                                • Instruction Fuzzy Hash: D0E086B1502108EBCB40DFE4EA427DCB7B9DB40210F10819DD40CE7250DA755F004751
                                                                                                Function 05112F80 Relevance: .0, Instructions: 18COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 40ed49ee9baab9d81257a7beab6040ae9ce921bb6d4186000255884d87f4aabb
                                                                                                • Instruction ID: b4963c74ab2c4fa2d65992974e997d2b7388606e20092283671b3b86a7280c2e
                                                                                                • Opcode Fuzzy Hash: 40ed49ee9baab9d81257a7beab6040ae9ce921bb6d4186000255884d87f4aabb
                                                                                                • Instruction Fuzzy Hash: 08D0A736A1061463CB0026B4B8C67EBBB8DCB44120F0040F1ED18D6306CE7DCD0003C4
                                                                                                Function 05111D10 Relevance: .0, Instructions: 17COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 5a6a9d8705e6e82c4badf81642ecd3834d9cd6c0967fff61430dd85e1d9b66de
                                                                                                • Instruction ID: 0e7d328bd8c9f55390659fcea9edd83d3c339b62425a08ceda589111292ed9c3
                                                                                                • Opcode Fuzzy Hash: 5a6a9d8705e6e82c4badf81642ecd3834d9cd6c0967fff61430dd85e1d9b66de
                                                                                                • Instruction Fuzzy Hash: C9D0A7307C070D2BFB042160A81D77672A96740718F5000B4EF0D091C18BA844C1C168
                                                                                                Function 05110C0C Relevance: .0, Instructions: 17COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 4b7a010ce0d3d72a465763726f016217be279a9176871d88bcd0c78cf4d02039
                                                                                                • Instruction ID: e1ebab39753299e723c4f6f582e1c2e95a106ddfd3722ce93d0f7a738f13177f
                                                                                                • Opcode Fuzzy Hash: 4b7a010ce0d3d72a465763726f016217be279a9176871d88bcd0c78cf4d02039
                                                                                                • Instruction Fuzzy Hash: CAD0A73231402CAB82056A19E88997A7BAAEB982A03508477FE0183220CE705C4187AD
                                                                                                Function 05111C29 Relevance: .0, Instructions: 17COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 85a502b8e49cb10902f652ede4c46c94a0bb468697df097de474e788f46be1ed
                                                                                                • Instruction ID: 3ef4001dd5013e32f85f40bf052e508d7c78b8a32715a93ac2095db73ab56d35
                                                                                                • Opcode Fuzzy Hash: 85a502b8e49cb10902f652ede4c46c94a0bb468697df097de474e788f46be1ed
                                                                                                • Instruction Fuzzy Hash: DDC02227B8E63833860120AC7C0238AB7088B06910F020CF2DD58C2203910A9C4086EA
                                                                                                Function 051117F0 Relevance: .0, Instructions: 16COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: d231afb93e4142d2f06135885ea6c3368a6f989b4c1a105fc3b127c309e044d4
                                                                                                • Instruction ID: c12d7f769ff4e63f8710bf9ae99d0a103d8818574468d8ed245cdf1a633c94a3
                                                                                                • Opcode Fuzzy Hash: d231afb93e4142d2f06135885ea6c3368a6f989b4c1a105fc3b127c309e044d4
                                                                                                • Instruction Fuzzy Hash: EDD0A73B60A0D48FC306DB70E4097D67FB3A768261B0884ABE98147623CB350956C798
                                                                                                Function 05117F78 Relevance: .0, Instructions: 16COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 608a317e93cb1deeb0bf0b0059595463a5b8147f7d459220757736c98ad94e46
                                                                                                • Instruction ID: 68d66fdb201851846295ca563901770c2c8dd56e03b363cd746765cb171c2e9f
                                                                                                • Opcode Fuzzy Hash: 608a317e93cb1deeb0bf0b0059595463a5b8147f7d459220757736c98ad94e46
                                                                                                • Instruction Fuzzy Hash: 1DD017B4A01209EFCB41DFA9E90159DBBF9EB49204B1089ADD508E7200EF352F409B95
                                                                                                Function 05112968 Relevance: .0, Instructions: 16COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: a1836cb1f53d8c46b99c0247e16e3f096eb176045365b379ff6fd3966da015d6
                                                                                                • Instruction ID: e2007b0a318076c00b83dbafca8f28f229898d8f0d11a0ca46b0f0d5b0bc78f8
                                                                                                • Opcode Fuzzy Hash: a1836cb1f53d8c46b99c0247e16e3f096eb176045365b379ff6fd3966da015d6
                                                                                                • Instruction Fuzzy Hash: 09D05B7490210DEFCB40DFA5EA4195DBBF9EF44210B1085DDD909D7250DA715F009791
                                                                                                Function 05110F50 Relevance: .0, Instructions: 13COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 04bd1a4b88cd79bec145b1af09b0b0a12e9a35969d624360af7f49cbfc242dcb
                                                                                                • Instruction ID: 6c99ea53b083d603df22f9c1ebadb05bb7c58fca2c43eb0f438c9e571645237b
                                                                                                • Opcode Fuzzy Hash: 04bd1a4b88cd79bec145b1af09b0b0a12e9a35969d624360af7f49cbfc242dcb
                                                                                                • Instruction Fuzzy Hash: E1C08C21B9060DABD9143A66B66EB3E795FAB80600F401CB87E0E85000EE689440814C
                                                                                                Function 05111D28 Relevance: .0, Instructions: 9COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: e1b4856ecf3945cbd6df3c1938b3e450a4d7273528038f118f2f1f80e4ed9f17
                                                                                                • Instruction ID: bad92453a7e8744f01dd6bd8cabdb7af0c58d824e50695e83f09ab3ca3762132
                                                                                                • Opcode Fuzzy Hash: e1b4856ecf3945cbd6df3c1938b3e450a4d7273528038f118f2f1f80e4ed9f17
                                                                                                • Instruction Fuzzy Hash: 43C092307D030CBBFB1426A0EC2AB7D7626ABD0B09F544471FA1EBE2C1CEA58C41C254
                                                                                                Function 05110440 Relevance: .0, Instructions: 8COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 8ba6d8e69e3b48cfe9d804d3e2b95b4390362f7ab50750911277d77ca2a60ff8
                                                                                                • Instruction ID: a42f5e56b38fd53fcf3565dc64baed1ac702a174c2e961350f76c4a721e88075
                                                                                                • Opcode Fuzzy Hash: 8ba6d8e69e3b48cfe9d804d3e2b95b4390362f7ab50750911277d77ca2a60ff8
                                                                                                • Instruction Fuzzy Hash: 24C04C324A41406FC7018694DD06BA97F62B7A2325F954665E08041521CB2D4512D750
                                                                                                Function 05110E7C Relevance: .0, Instructions: 8COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000005.00000003.2154017505.0000000005110000.00000040.00000800.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_5_3_5110000_rundll32.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 713258398d9d328509e40863db6abcbd26d26bc0a80c35f6e8bda39839ebf772
                                                                                                • Instruction ID: 2f9ac6b042404ca30879b9ac8dde37f8f4c558a74c73ee885c46f7943968fbe5
                                                                                                • Opcode Fuzzy Hash: 713258398d9d328509e40863db6abcbd26d26bc0a80c35f6e8bda39839ebf772
                                                                                                • Instruction Fuzzy Hash: F3B01206A44005736108FE3599D887A44A396C0200BC0DCA42D01500058E18C100000C

                                                                                                Execution Graph

                                                                                                Execution Coverage:9.7%
                                                                                                Dynamic/Decrypted Code Coverage:100%
                                                                                                Signature Coverage:5.6%
                                                                                                Total number of Nodes:107
                                                                                                Total number of Limit Nodes:2
                                                                                                execution_graph 39973 5e22d40 39974 5e22d41 39973->39974 39975 5e22df9 RegDisablePredefinedCache 39974->39975 39976 5e22ddc 39974->39976 39975->39976 39920 1e336b0 39922 1e336c6 39920->39922 39921 1e33764 39922->39921 39925 1e3e5e6 39922->39925 39923 1e33739 39926 1e3e614 39925->39926 39927 1e3e62e 39925->39927 39926->39927 39930 4480ba0 39926->39930 39934 4480bb0 39926->39934 39927->39923 39931 4480bb0 39930->39931 39937 4480bee 39931->39937 39932 4480bd5 39932->39927 39936 4480bee CryptProtectData 39934->39936 39935 4480bd5 39935->39927 39936->39935 39938 4480c0d 39937->39938 39939 4480c19 39937->39939 39938->39932 39943 44811f8 39939->39943 39952 44811f0 39939->39952 39940 4480c95 39940->39932 39944 448121d 39943->39944 39947 44812e4 39943->39947 39944->39947 39948 44811f8 CryptProtectData 39944->39948 39950 44811f0 CryptProtectData 39944->39950 39961 44814b3 39944->39961 39965 448144f 39944->39965 39945 448150d 39945->39940 39947->39945 39969 4480f08 39947->39969 39948->39947 39950->39947 39953 448121d 39952->39953 39956 44812e4 39952->39956 39953->39956 39957 44811f8 CryptProtectData 39953->39957 39958 448144f CryptProtectData 39953->39958 39959 44811f0 CryptProtectData 39953->39959 39960 44814b3 CryptProtectData 39953->39960 39954 448150d 39954->39940 39955 4480f08 CryptProtectData 39955->39954 39956->39954 39956->39955 39957->39956 39958->39956 39959->39956 39960->39956 39962 44814d5 39961->39962 39963 448150d 39962->39963 39964 4480f08 CryptProtectData 39962->39964 39963->39947 39964->39963 39966 4481463 39965->39966 39967 448150d 39966->39967 39968 4480f08 CryptProtectData 39966->39968 39967->39947 39968->39967 39970 44816f8 CryptProtectData 39969->39970 39972 4481783 39970->39972 39972->39945 39977 5e40040 39978 5e40071 39977->39978 39980 5e40207 39978->39980 39984 5e41350 39978->39984 39988 5e4133f 39978->39988 39979 5e40a4e 39979->39979 39992 5e45e1e 39980->39992 39985 5e4135f 39984->39985 40000 5e413b0 39985->40000 39989 5e4135f 39988->39989 39991 5e413b0 2 API calls 39989->39991 39990 5e41374 39990->39980 39991->39990 39993 5e45e3e 39992->39993 39995 5e45e57 39993->39995 40013 5e45f80 39993->40013 40021 5e45f70 39993->40021 39994 5e45e80 39998 5e45f80 3 API calls 39994->39998 39999 5e45f70 3 API calls 39994->39999 39995->39979 39998->39995 39999->39995 40001 5e413eb 40000->40001 40005 5e42280 40001->40005 40009 5e42278 40001->40009 40002 5e414b9 40006 5e422d3 CreateProcessAsUserW 40005->40006 40008 5e42364 40006->40008 40008->40002 40010 5e422d3 CreateProcessAsUserW 40009->40010 40012 5e42364 40010->40012 40012->40002 40014 5e45f8d 40013->40014 40016 5e45fc4 40014->40016 40029 5e4528c 40014->40029 40033 5e205c4 40016->40033 40042 5e2056f 40016->40042 40047 5e20580 40016->40047 40017 5e45fcf 40017->39994 40022 5e45f8d 40021->40022 40023 5e4528c WaitNamedPipeW 40022->40023 40024 5e45fc4 40022->40024 40023->40022 40026 5e20580 2 API calls 40024->40026 40027 5e205c4 2 API calls 40024->40027 40028 5e2056f 2 API calls 40024->40028 40025 5e45fcf 40025->39994 40026->40025 40027->40025 40028->40025 40030 5e45fe8 WaitNamedPipeW 40029->40030 40032 5e46064 40030->40032 40032->40014 40034 5e205c8 40033->40034 40035 5e205b0 40034->40035 40037 5e205cf CreateFileA 40034->40037 40041 5e205c4 CreateFileA 40035->40041 40052 5e205d0 40035->40052 40036 5e205b8 40036->40017 40039 5e20705 40037->40039 40041->40036 40043 5e20574 40042->40043 40044 5e205b8 40043->40044 40045 5e205d0 CreateFileA 40043->40045 40046 5e205c4 2 API calls 40043->40046 40044->40017 40045->40044 40046->40044 40048 5e20581 40047->40048 40049 5e205b8 40048->40049 40050 5e205d0 CreateFileA 40048->40050 40051 5e205c4 2 API calls 40048->40051 40049->40017 40050->40049 40051->40049 40053 5e205d1 CreateFileA 40052->40053 40055 5e20705 40053->40055

                                                                                                Executed Functions

                                                                                                Function 05E42280 Relevance: 1.6, APIs: 1, Instructions: 93processCOMMON
                                                                                                Download Yara Rule

                                                                                                Control-flow Graph

                                                                                                • Executed
                                                                                                • Not Executed
                                                                                                control_flow_graph 69 5e42280-5e422d1 70 5e422d3-5e422d9 69->70 71 5e422dc-5e422e0 69->71 70->71 72 5e422e2-5e422e5 71->72 73 5e422e8-5e422fd 71->73 72->73 74 5e422ff-5e42308 73->74 75 5e4230b-5e42362 CreateProcessAsUserW 73->75 74->75 76 5e42364-5e4236a 75->76 77 5e4236b-5e42393 75->77 76->77
                                                                                                APIs
                                                                                                • CreateProcessAsUserW.KERNEL32(?,00000000,00000000,?,?,?,?,?,00000000,?,?), ref: 05E4234F
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000008.00000002.3412902131.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_8_2_5e40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID: CreateProcessUser
                                                                                                • String ID:
                                                                                                • API String ID: 2217836671-0
                                                                                                • Opcode ID: 7df2ab398534d6522d9f2a08e5f4c00a2ca851a137d464f407b0202b6d252fad
                                                                                                • Instruction ID: ec75fae3c0ed431b3eb48d13877df45408dafcf3558cd56d1b45546aaec9d3fe
                                                                                                • Opcode Fuzzy Hash: 7df2ab398534d6522d9f2a08e5f4c00a2ca851a137d464f407b0202b6d252fad
                                                                                                • Instruction Fuzzy Hash: DD41427690020ADFDF10CFA9D884ADEBBF2FF48310F14842AE958A7250D775A965CF90
                                                                                                Function 04480F08 Relevance: 1.6, APIs: 1, Instructions: 64encryptionCOMMON
                                                                                                Download Yara Rule

                                                                                                Control-flow Graph

                                                                                                • Executed
                                                                                                • Not Executed
                                                                                                control_flow_graph 172 4480f08-4481738 174 448173a-448173d 172->174 175 4481740-4481781 CryptProtectData 172->175 174->175 176 448178a-44817b2 175->176 177 4481783-4481789 175->177 177->176
                                                                                                APIs
                                                                                                • CryptProtectData.CRYPT32(?,00000000,?,?,?,?,?), ref: 0448176E
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000008.00000002.3403727381.0000000004480000.00000040.00000800.00020000.00000000.sdmp, Offset: 04480000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_8_2_4480000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID: CryptDataProtect
                                                                                                • String ID:
                                                                                                • API String ID: 3091777813-0
                                                                                                • Opcode ID: f7dd02c99a2ddadcf57f97d3f3c53a5421995a1c78db8b2f6e3f2c285003f9df
                                                                                                • Instruction ID: 616e06ef2373497234234efc8de580648b4607552bd731a72ae23fa2e2ef8231
                                                                                                • Opcode Fuzzy Hash: f7dd02c99a2ddadcf57f97d3f3c53a5421995a1c78db8b2f6e3f2c285003f9df
                                                                                                • Instruction Fuzzy Hash: EB2134B680024ADFDF10CF9AC844ADEBBB5FB88310F14841EE919A7210D379A556CFA1
                                                                                                Function 044816F1 Relevance: 1.6, APIs: 1, Instructions: 64encryptionCOMMON
                                                                                                Download Yara Rule

                                                                                                Control-flow Graph

                                                                                                • Executed
                                                                                                • Not Executed
                                                                                                control_flow_graph 180 44816f1-4481738 181 448173a-448173d 180->181 182 4481740-4481781 CryptProtectData 180->182 181->182 183 448178a-44817b2 182->183 184 4481783-4481789 182->184 184->183
                                                                                                APIs
                                                                                                • CryptProtectData.CRYPT32(?,00000000,?,?,?,?,?), ref: 0448176E
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000008.00000002.3403727381.0000000004480000.00000040.00000800.00020000.00000000.sdmp, Offset: 04480000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_8_2_4480000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID: CryptDataProtect
                                                                                                • String ID:
                                                                                                • API String ID: 3091777813-0
                                                                                                • Opcode ID: d1f3538c291501b852fe9311df2efab22e910c8d4d5e830c3b5d7a85d84ed859
                                                                                                • Instruction ID: a54de977f065648bcd04048f335630f9d08322fbc39b189d330cdb0dc23b70e3
                                                                                                • Opcode Fuzzy Hash: d1f3538c291501b852fe9311df2efab22e910c8d4d5e830c3b5d7a85d84ed859
                                                                                                • Instruction Fuzzy Hash: 392116B6800249DFDF10CF9AC844ADEBBB1FF88310F14841AE959A7210D779A556DFA1
                                                                                                Function 05E205C4 Relevance: 1.6, APIs: 1, Instructions: 127fileCOMMON
                                                                                                Download Yara Rule

                                                                                                Control-flow Graph

                                                                                                • Executed
                                                                                                • Not Executed
                                                                                                control_flow_graph 6 5e205c4-5e205c6 7 5e205c8-5e205ca 6->7 8 5e205cd 6->8 9 5e205d1-5e2062c 7->9 10 5e205cc 7->10 11 5e205b0 8->11 12 5e205cf 8->12 13 5e20680-5e20703 CreateFileA 9->13 14 5e2062e-5e20653 9->14 10->8 34 5e205b3 call 5e205d0 11->34 35 5e205b3 call 5e205c4 11->35 12->9 24 5e20705-5e2070b 13->24 25 5e2070c-5e2074a 13->25 14->13 18 5e20655-5e20657 14->18 15 5e205b8-5e205ba 19 5e2067a-5e2067d 18->19 20 5e20659-5e20663 18->20 19->13 22 5e20667-5e20676 20->22 23 5e20665 20->23 22->22 26 5e20678 22->26 23->22 24->25 30 5e2075a 25->30 31 5e2074c-5e20750 25->31 26->19 33 5e2075b 30->33 31->30 32 5e20752 31->32 32->30 33->33 34->15 35->15
                                                                                                APIs
                                                                                                • CreateFileA.KERNEL32(?,?,?,?,?,00000001,00000004), ref: 05E206ED
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000008.00000002.3412702450.0000000005E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_8_2_5e20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID: CreateFile
                                                                                                • String ID:
                                                                                                • API String ID: 823142352-0
                                                                                                • Opcode ID: 34280f35d1ff2917e286e79e8e30c274660edcee7315cf83ab7756c6c20b133c
                                                                                                • Instruction ID: f4458584e77c6245618b19eb9b6e00e7688a546a569a69213d18656355b8c59c
                                                                                                • Opcode Fuzzy Hash: 34280f35d1ff2917e286e79e8e30c274660edcee7315cf83ab7756c6c20b133c
                                                                                                • Instruction Fuzzy Hash: 535168B1D00259DFEB10CFA9C888B9EBFF1FB48704F148169E849AB295D7B59845CF81
                                                                                                Function 05E205D0 Relevance: 1.6, APIs: 1, Instructions: 116fileCOMMON
                                                                                                Download Yara Rule

                                                                                                Control-flow Graph

                                                                                                • Executed
                                                                                                • Not Executed
                                                                                                control_flow_graph 36 5e205d0-5e2062c 38 5e20680-5e20703 CreateFileA 36->38 39 5e2062e-5e20653 36->39 48 5e20705-5e2070b 38->48 49 5e2070c-5e2074a 38->49 39->38 42 5e20655-5e20657 39->42 43 5e2067a-5e2067d 42->43 44 5e20659-5e20663 42->44 43->38 46 5e20667-5e20676 44->46 47 5e20665 44->47 46->46 50 5e20678 46->50 47->46 48->49 54 5e2075a 49->54 55 5e2074c-5e20750 49->55 50->43 57 5e2075b 54->57 55->54 56 5e20752 55->56 56->54 57->57
                                                                                                APIs
                                                                                                • CreateFileA.KERNEL32(?,?,?,?,?,00000001,00000004), ref: 05E206ED
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000008.00000002.3412702450.0000000005E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_8_2_5e20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID: CreateFile
                                                                                                • String ID:
                                                                                                • API String ID: 823142352-0
                                                                                                • Opcode ID: 84a19e952b19c8bfcacff46df366e772067bcff6cf2d1aa720c16efc25df9c08
                                                                                                • Instruction ID: 0c7b475ba4b639ee4e588e54758e9f13234f219f7a308f081091191a0de22e46
                                                                                                • Opcode Fuzzy Hash: 84a19e952b19c8bfcacff46df366e772067bcff6cf2d1aa720c16efc25df9c08
                                                                                                • Instruction Fuzzy Hash: D54158B1D00359DFEB10CFA9C848B9EBBF2FB48704F148129E858AB295D7B59845CF81
                                                                                                Function 05E42278 Relevance: 1.6, APIs: 1, Instructions: 95processCOMMON
                                                                                                Download Yara Rule

                                                                                                Control-flow Graph

                                                                                                • Executed
                                                                                                • Not Executed
                                                                                                control_flow_graph 58 5e42278-5e422d1 59 5e422d3-5e422d9 58->59 60 5e422dc-5e422e0 58->60 59->60 61 5e422e2-5e422e5 60->61 62 5e422e8-5e422fd 60->62 61->62 63 5e422ff-5e42308 62->63 64 5e4230b-5e42362 CreateProcessAsUserW 62->64 63->64 65 5e42364-5e4236a 64->65 66 5e4236b-5e42393 64->66 65->66
                                                                                                APIs
                                                                                                • CreateProcessAsUserW.KERNEL32(?,00000000,00000000,?,?,?,?,?,00000000,?,?), ref: 05E4234F
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000008.00000002.3412902131.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_8_2_5e40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID: CreateProcessUser
                                                                                                • String ID:
                                                                                                • API String ID: 2217836671-0
                                                                                                • Opcode ID: 6efbdc4b7d334975932f11e8db67741fba3e2cbda1096e61b7b1c73823b02d93
                                                                                                • Instruction ID: 434153e6bc04ee079c97e02b550e5428594202a79b7ad3e43f15a24ebd7903c1
                                                                                                • Opcode Fuzzy Hash: 6efbdc4b7d334975932f11e8db67741fba3e2cbda1096e61b7b1c73823b02d93
                                                                                                • Instruction Fuzzy Hash: 9D41447690020ADFDF10CFA9D884ADEBBF2FF48310F14842AE958A7250D775A965CF90
                                                                                                Function 05E22D40 Relevance: 1.6, APIs: 1, Instructions: 91registryCOMMON
                                                                                                Download Yara Rule

                                                                                                Control-flow Graph

                                                                                                • Executed
                                                                                                • Not Executed
                                                                                                control_flow_graph 80 5e22d40-5e22dcb 88 5e22ddc-5e22df4 80->88 89 5e22dcd-5e22dda 80->89 90 5e22eb6-5e22ebe 88->90 89->88 93 5e22df9-5e22e28 RegDisablePredefinedCache 89->93 96 5e22ebf 90->96 94 5e22e31-5e22e4c call 5e22c08 93->94 95 5e22e2a-5e22e30 93->95 100 5e22e51-5e22e6d 94->100 95->94 96->96 103 5e22e78 100->103 104 5e22e6f 100->104 103->90 104->103
                                                                                                APIs
                                                                                                • RegDisablePredefinedCache.ADVAPI32 ref: 05E22E11
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000008.00000002.3412702450.0000000005E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_8_2_5e20000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID: CacheDisablePredefined
                                                                                                • String ID:
                                                                                                • API String ID: 1885667121-0
                                                                                                • Opcode ID: 3f243b097bb8b45e22d205e428b187c3e8c48fe9fb706cd9c3cf17fed6159136
                                                                                                • Instruction ID: 7f528d60424c2dd193998d0bf04cd3cac22576d76a4d54b42ae4e30968a43e64
                                                                                                • Opcode Fuzzy Hash: 3f243b097bb8b45e22d205e428b187c3e8c48fe9fb706cd9c3cf17fed6159136
                                                                                                • Instruction Fuzzy Hash: 92316774D00218DBEB14DFA9D844BEEBBB6BF88314F10902AD905AB394DBB46845CF51
                                                                                                Function 05E45FE0 Relevance: 1.6, APIs: 1, Instructions: 60pipeCOMMON
                                                                                                Download Yara Rule

                                                                                                Control-flow Graph

                                                                                                • Executed
                                                                                                • Not Executed
                                                                                                control_flow_graph 187 5e45fe0-5e45fe6 188 5e45fec-5e46028 187->188 189 5e45fe8-5e45feb 187->189 190 5e46030-5e46062 WaitNamedPipeW 188->190 191 5e4602a-5e4602d 188->191 189->188 192 5e46064-5e4606a 190->192 193 5e4606b-5e46093 190->193 191->190 192->193
                                                                                                APIs
                                                                                                • WaitNamedPipeW.KERNEL32(00000000,0000000A,?,?,?,?,?,?,?,05E45FA6), ref: 05E4604F
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000008.00000002.3412902131.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_8_2_5e40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID: NamedPipeWait
                                                                                                • String ID:
                                                                                                • API String ID: 3146367894-0
                                                                                                • Opcode ID: 25f08bba86e65e52225fa5f6b536c52dac9d5c157e0d5762b9e92927dcf91531
                                                                                                • Instruction ID: 98ceff22761d64194415c7b0fa7a103ae275a2d619b38461500f2e174860b9db
                                                                                                • Opcode Fuzzy Hash: 25f08bba86e65e52225fa5f6b536c52dac9d5c157e0d5762b9e92927dcf91531
                                                                                                • Instruction Fuzzy Hash: C92135B28003098FDB20CF9AD844AEEBBF4EB48324F14846ED859A7201D779A545CFA1
                                                                                                Function 05E4528C Relevance: 1.6, APIs: 1, Instructions: 59pipeCOMMON
                                                                                                Download Yara Rule

                                                                                                Control-flow Graph

                                                                                                • Executed
                                                                                                • Not Executed
                                                                                                control_flow_graph 196 5e4528c-5e46028 199 5e46030-5e46062 WaitNamedPipeW 196->199 200 5e4602a-5e4602d 196->200 201 5e46064-5e4606a 199->201 202 5e4606b-5e46093 199->202 200->199 201->202
                                                                                                APIs
                                                                                                • WaitNamedPipeW.KERNEL32(00000000,0000000A,?,?,?,?,?,?,?,05E45FA6), ref: 05E4604F
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000008.00000002.3412902131.0000000005E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E40000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_8_2_5e40000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID: NamedPipeWait
                                                                                                • String ID:
                                                                                                • API String ID: 3146367894-0
                                                                                                • Opcode ID: c02fe362e2ec69b10e06fc0486e7f70a1c669e2a4c7f22b7c8e14e61d991b83e
                                                                                                • Instruction ID: d5a7e3228ec659570227ac25f8ee4299f418bbd2a7bfe868ac831d45f72a045e
                                                                                                • Opcode Fuzzy Hash: c02fe362e2ec69b10e06fc0486e7f70a1c669e2a4c7f22b7c8e14e61d991b83e
                                                                                                • Instruction Fuzzy Hash: 162127B68043098FDB20CF9AD444BEEBBF4FB48324F10846ED459A7241D779A545CFA1
                                                                                                Function 015ED670 Relevance: .1, Instructions: 75COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000008.00000002.3383765073.00000000015ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_8_2_15ed000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 9fe646de05bf074c08e1bf068f3a0d937e09e1a23cb0da2c91f4e6781be4c713
                                                                                                • Instruction ID: f78f168077100ecb4619cfa9ddeeb1639e3cdbf4658e9fa7012be259c54599a6
                                                                                                • Opcode Fuzzy Hash: 9fe646de05bf074c08e1bf068f3a0d937e09e1a23cb0da2c91f4e6781be4c713
                                                                                                • Instruction Fuzzy Hash: 6A2145B6944280DFDB09DF54D9C4B2ABFF5FB88320F20856CE9090F256C336D416CAA1
                                                                                                Function 015ED66B Relevance: .1, Instructions: 56COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000008.00000002.3383765073.00000000015ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_8_2_15ed000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
                                                                                                • Instruction ID: 33a58c3bda3d470962c7046966b64c76afb62193f9e6390235b9562e4404be7e
                                                                                                • Opcode Fuzzy Hash: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
                                                                                                • Instruction Fuzzy Hash: F511A276944280CFCB16CF54D5C4B1ABFB1FB84314F2485A9D8090B257C336D456CB91
                                                                                                Function 015ED01D Relevance: .0, Instructions: 45COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000008.00000002.3383765073.00000000015ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_8_2_15ed000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: bf6f7d8d3afe84769ffdc381c9ebb3c3a8bb01cccc6e6966692bfc048ae745ca
                                                                                                • Instruction ID: 118cc70f4b48c5e12eabf2602b198a4dc8a4728eabd5d582466ac65d565b8e42
                                                                                                • Opcode Fuzzy Hash: bf6f7d8d3afe84769ffdc381c9ebb3c3a8bb01cccc6e6966692bfc048ae745ca
                                                                                                • Instruction Fuzzy Hash: 9601F7718083409AF7144A69CD88B6ABFE8FF413A4F1CC45AEE090F282D6B99445C6B1
                                                                                                Function 015ED006 Relevance: .0, Instructions: 45COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000008.00000002.3383765073.00000000015ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_8_2_15ed000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 45ed5985faf44c5209b56297b5015a052b251ea61c67ec03cdb170028a37adcd
                                                                                                • Instruction ID: 1423d6db03d64d8cb001a99926310e867585195b54d4eee6f4228485a05e8972
                                                                                                • Opcode Fuzzy Hash: 45ed5985faf44c5209b56297b5015a052b251ea61c67ec03cdb170028a37adcd
                                                                                                • Instruction Fuzzy Hash: EB01407240E3C09FE7178B258894756BFB4EF43224F1D80DBD9888F1A3D2695848C772

                                                                                                Non-executed Functions

                                                                                                Function 01E34D2E Relevance: 1.6, APIs: 1, Instructions: 59COMMON
                                                                                                Download Yara Rule
                                                                                                APIs
                                                                                                • RtlGetVersion.NTDLL(0000009C), ref: 01E34DBE
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000008.00000002.3384350199.0000000001E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 01E30000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_8_2_1e30000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID: Version
                                                                                                • String ID:
                                                                                                • API String ID: 1889659487-0
                                                                                                • Opcode ID: 733f46f037c2c83f0e0c6368def6460daac3ed26485ed15038d9a61134ccc69a
                                                                                                • Instruction ID: ee9ba6d6b5afae95801fb37f25f01f039913b1a44eae2967d9e72543872e32ee
                                                                                                • Opcode Fuzzy Hash: 733f46f037c2c83f0e0c6368def6460daac3ed26485ed15038d9a61134ccc69a
                                                                                                • Instruction Fuzzy Hash: 49212571901329DFEB60CF59C808B99FBB9FB44314F1081D9D10CA7680C7756A98CF92

                                                                                                Execution Graph

                                                                                                Execution Coverage:11.4%
                                                                                                Dynamic/Decrypted Code Coverage:100%
                                                                                                Signature Coverage:0%
                                                                                                Total number of Nodes:5
                                                                                                Total number of Limit Nodes:1
                                                                                                execution_graph 19731 7ffd342d8014 19733 7ffd342d801d 19731->19733 19732 7ffd342d8082 19733->19732 19734 7ffd342d80f6 SetProcessMitigationPolicy 19733->19734 19735 7ffd342d8152 19734->19735

                                                                                                Executed Functions

                                                                                                Function 00007FFD345E9A28 Relevance: 11.9, Strings: 8, Instructions: 1905COMMON
                                                                                                Download Yara Rule
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: H*h4$H\/4$Pu^4$X(h4$Xv^4$X]4$p\/4$0]4
                                                                                                • API String ID: 0-4104381412
                                                                                                • Opcode ID: dfa085c8f18130fd262e533d441f8349c77df9e14738bfd5bcdb75bfb0312a6a
                                                                                                • Instruction ID: dc4fce754fe3e5ea4531bc2bfd74d4cc145222b70b721efaf88050b68f7bd755
                                                                                                • Opcode Fuzzy Hash: dfa085c8f18130fd262e533d441f8349c77df9e14738bfd5bcdb75bfb0312a6a
                                                                                                • Instruction Fuzzy Hash: 41E29130E096198FEBA9DB28C8A47E973E1EF59300F5441B9D54DE7292CE39AD81DB40
                                                                                                Function 00007FFD345E6531 Relevance: 8.2, Strings: 6, Instructions: 745COMMON
                                                                                                Download Yara Rule

                                                                                                Control-flow Graph

                                                                                                • Executed
                                                                                                • Not Executed
                                                                                                control_flow_graph 469 7ffd345e6531-7ffd345e6564 call 7ffd345e4aa0 call 7ffd345e0c40 * 2 477 7ffd345e656a-7ffd345e6578 469->477 478 7ffd345e72fe-7ffd345e7311 469->478 480 7ffd345e657a-7ffd345e657c 477->480 481 7ffd345e657e-7ffd345e658d 477->481 482 7ffd345e6590-7ffd345e6592 480->482 481->482 484 7ffd345e6598-7ffd345e65b4 482->484 485 7ffd345e66d2-7ffd345e66d5 482->485 484->485 500 7ffd345e65ba-7ffd345e65cc 484->500 486 7ffd345e66db-7ffd345e66e6 485->486 487 7ffd345e6810-7ffd345e6817 485->487 490 7ffd345e66e8-7ffd345e6730 486->490 491 7ffd345e6732-7ffd345e6740 486->491 488 7ffd345e68a7-7ffd345e68ae 487->488 489 7ffd345e681d-7ffd345e6824 487->489 495 7ffd345e68b9-7ffd345e68cc 488->495 496 7ffd345e68b0-7ffd345e68b7 488->496 489->488 494 7ffd345e682a-7ffd345e6834 489->494 490->491 491->487 498 7ffd345e68f6-7ffd345e68fd 494->498 510 7ffd345e683a-7ffd345e684e 494->510 512 7ffd345e68ce-7ffd345e68d3 495->512 513 7ffd345e68dd-7ffd345e68e5 495->513 496->495 496->498 501 7ffd345e6b61-7ffd345e6b68 498->501 502 7ffd345e6903-7ffd345e690a 498->502 506 7ffd345e661a-7ffd345e6628 500->506 507 7ffd345e65ce-7ffd345e65df 500->507 501->478 508 7ffd345e6b6e-7ffd345e6b75 501->508 502->501 509 7ffd345e6910-7ffd345e6913 502->509 523 7ffd345e6629-7ffd345e666d 506->523 507->523 524 7ffd345e65e1-7ffd345e65eb 507->524 508->478 517 7ffd345e6b7b-7ffd345e6b8d 508->517 518 7ffd345e691c-7ffd345e692a 509->518 519 7ffd345e6915-7ffd345e6917 509->519 512->513 515 7ffd345e68eb-7ffd345e68ef 513->515 516 7ffd345e7351-7ffd345e7383 513->516 515->498 525 7ffd345e6bd9-7ffd345e6bec 517->525 526 7ffd345e6b8f-7ffd345e6bac 517->526 539 7ffd345e692c 518->539 540 7ffd345e692e 518->540 527 7ffd345e69ca-7ffd345e69cd 519->527 568 7ffd345e666e-7ffd345e66a6 523->568 529 7ffd345e7312-7ffd345e7335 524->529 530 7ffd345e65f1-7ffd345e6618 524->530 544 7ffd345e6bf3-7ffd345e6bfe 525->544 537 7ffd345e6bb2-7ffd345e6bd7 526->537 538 7ffd345e733f-7ffd345e7350 526->538 533 7ffd345e69d6-7ffd345e69e4 527->533 534 7ffd345e69cf-7ffd345e69d1 527->534 603 7ffd345e7336-7ffd345e733e 529->603 530->506 560 7ffd345e69e6 533->560 561 7ffd345e69e8 533->561 541 7ffd345e6a85-7ffd345e6a8b 534->541 537->525 538->516 547 7ffd345e6930-7ffd345e6933 539->547 540->547 542 7ffd345e6a91-7ffd345e6a93 541->542 543 7ffd345e6b3d-7ffd345e6b3f 541->543 542->543 551 7ffd345e6a99-7ffd345e6b3b 542->551 543->501 552 7ffd345e6b41-7ffd345e6b49 543->552 553 7ffd345e6ca1-7ffd345e6ca7 544->553 554 7ffd345e6c04-7ffd345e6c1c 544->554 558 7ffd345e6935-7ffd345e693b 547->558 559 7ffd345e693d-7ffd345e6948 547->559 551->501 552->501 569 7ffd345e6b4b-7ffd345e6b5d 552->569 553->478 566 7ffd345e6cad-7ffd345e6cb5 553->566 554->553 585 7ffd345e6c22-7ffd345e6c84 554->585 571 7ffd345e69b8-7ffd345e69c8 558->571 562 7ffd345e694a-7ffd345e6992 559->562 563 7ffd345e6994-7ffd345e69b5 559->563 567 7ffd345e69ea-7ffd345e69ed 560->567 561->567 562->563 563->571 577 7ffd345e6cb7-7ffd345e6cf6 566->577 578 7ffd345e6cfd-7ffd345e6d05 566->578 579 7ffd345e69f7-7ffd345e6a02 567->579 580 7ffd345e69ef-7ffd345e69f5 567->580 568->485 588 7ffd345e66a8-7ffd345e66ca 568->588 571->527 577->578 578->478 591 7ffd345e6d0b-7ffd345e6d80 578->591 589 7ffd345e6a04-7ffd345e6a21 579->589 590 7ffd345e6a4e-7ffd345e6a70 579->590 587 7ffd345e6a73-7ffd345e6a83 580->587 585->553 587->541 588->568 614 7ffd345e66cc-7ffd345e66d0 588->614 589->603 604 7ffd345e6a27-7ffd345e6a4c 589->604 590->587 603->538 604->590 614->485 614->588
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: PM-4$XM-4$h4]4$h4]4$h4]4$Z^4
                                                                                                • API String ID: 0-202682871
                                                                                                • Opcode ID: 80671cca9d4d93b2875244a980dad01b7f5680384451dfe927f75b0a424f40cb
                                                                                                • Instruction ID: f25b84217e0669192c99eb3e9d0660a262439979a1f2866205d609be2a9dc458
                                                                                                • Opcode Fuzzy Hash: 80671cca9d4d93b2875244a980dad01b7f5680384451dfe927f75b0a424f40cb
                                                                                                • Instruction Fuzzy Hash: 1F324922F1EA464BEBAADA1C44A52F633D1EF56340F98407ED55EC71D3DD2CB8829340
                                                                                                Function 00007FFD345E000A Relevance: 6.9, Strings: 5, Instructions: 625COMMON
                                                                                                Download Yara Rule

                                                                                                Control-flow Graph

                                                                                                • Executed
                                                                                                • Not Executed
                                                                                                control_flow_graph 758 7ffd345e000a-7ffd345e008e 767 7ffd345e00d8-7ffd345e00dd 758->767 768 7ffd345e0090-7ffd345e00d7 758->768 770 7ffd345e00de 767->770 771 7ffd345e00df-7ffd345e0100 767->771 768->767 770->771 775 7ffd345e0102-7ffd345e0121 771->775 776 7ffd345e0124-7ffd345e013c 771->776 775->776 781 7ffd345e013e-7ffd345e015d 776->781 782 7ffd345e0160-7ffd345e017e 776->782 781->782 785 7ffd345e019a-7ffd345e01a5 782->785 786 7ffd345e0180-7ffd345e0198 782->786 789 7ffd345e01ab-7ffd345e01b4 785->789 790 7ffd345e023e-7ffd345e0241 785->790 786->785 792 7ffd345e01b6-7ffd345e01c3 789->792 793 7ffd345e01cd-7ffd345e01d8 789->793 794 7ffd345e0298-7ffd345e02a6 790->794 795 7ffd345e0243-7ffd345e024d 790->795 792->793 801 7ffd345e01c5-7ffd345e01cb 792->801 797 7ffd345e01da-7ffd345e01f7 793->797 798 7ffd345e0224-7ffd345e0238 793->798 807 7ffd345e02b0-7ffd345e02b6 794->807 802 7ffd345e0255-7ffd345e026e 795->802 805 7ffd345e04e2-7ffd345e053f 797->805 806 7ffd345e01fd-7ffd345e0222 797->806 798->790 804 7ffd345e04bd-7ffd345e04df 798->804 801->793 814 7ffd345e0270-7ffd345e0272 802->814 815 7ffd345e02df-7ffd345e02ea 802->815 804->805 840 7ffd345e054b-7ffd345e0552 805->840 841 7ffd345e0541-7ffd345e054a 805->841 806->798 812 7ffd345e02ba-7ffd345e02c6 807->812 813 7ffd345e0400-7ffd345e041e 807->813 818 7ffd345e02cc-7ffd345e02da 812->818 819 7ffd345e02c8-7ffd345e02ca 812->819 813->804 842 7ffd345e0424-7ffd345e042e 813->842 820 7ffd345e0274 814->820 821 7ffd345e02ee-7ffd345e02fa 814->821 822 7ffd345e02eb-7ffd345e02ec 815->822 826 7ffd345e02dd-7ffd345e02de 818->826 819->826 820->812 827 7ffd345e0276-7ffd345e027a 820->827 828 7ffd345e02fc-7ffd345e02fe 821->828 829 7ffd345e0300-7ffd345e0301 821->829 822->821 826->815 827->822 834 7ffd345e027c-7ffd345e0281 827->834 830 7ffd345e0311-7ffd345e0315 828->830 832 7ffd345e0302-7ffd345e030e 829->832 835 7ffd345e0316-7ffd345e032e 830->835 832->830 834->832 838 7ffd345e0283-7ffd345e028e 834->838 851 7ffd345e0334-7ffd345e0342 835->851 852 7ffd345e0330-7ffd345e0332 835->852 843 7ffd345e0290-7ffd345e0295 838->843 844 7ffd345e02ff 838->844 846 7ffd345e0554-7ffd345e055d 840->846 847 7ffd345e055e-7ffd345e0569 840->847 848 7ffd345e0434-7ffd345e0442 842->848 849 7ffd345e0430-7ffd345e0432 842->849 843->835 850 7ffd345e0297 843->850 844->829 853 7ffd345e0445-7ffd345e0462 848->853 849->853 850->794 855 7ffd345e0345-7ffd345e0362 851->855 852->855 859 7ffd345e0468-7ffd345e0476 853->859 860 7ffd345e0464-7ffd345e0466 853->860 862 7ffd345e0368-7ffd345e0376 855->862 863 7ffd345e0364-7ffd345e0366 855->863 864 7ffd345e0479-7ffd345e0496 859->864 860->864 865 7ffd345e0379-7ffd345e038f 862->865 863->865 870 7ffd345e049c-7ffd345e04aa 864->870 871 7ffd345e0498-7ffd345e049a 864->871 872 7ffd345e03a6-7ffd345e03ad 865->872 873 7ffd345e0391-7ffd345e03a4 865->873 874 7ffd345e04ad-7ffd345e04b6 870->874 871->874 877 7ffd345e03b4-7ffd345e03c7 872->877 873->872 878 7ffd345e03cd-7ffd345e03d0 873->878 874->804 877->878 879 7ffd345e03e7-7ffd345e03fa 878->879 880 7ffd345e03d2-7ffd345e03e5 878->880 879->813 880->813 880->879
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: 01G4$h4]4$0]4$2]4$\/4
                                                                                                • API String ID: 0-3608501992
                                                                                                • Opcode ID: 31567716500542b89b2c32b8cf0852aa58fcb5b1bc0dcab8f8a141d41bc034aa
                                                                                                • Instruction ID: f8c9a2a324b503230d95633d4131b5bfc80a647b3998e8dd3882e397c991b0a4
                                                                                                • Opcode Fuzzy Hash: 31567716500542b89b2c32b8cf0852aa58fcb5b1bc0dcab8f8a141d41bc034aa
                                                                                                • Instruction Fuzzy Hash: 4D12F762B0DA5A4FE79AEA2C98A16F637D1EF5B310F1800BAD54DC71D3DD1CA8819340
                                                                                                Function 00007FFD345E76F2 Relevance: 4.4, Strings: 3, Instructions: 606COMMON
                                                                                                Download Yara Rule

                                                                                                Control-flow Graph

                                                                                                • Executed
                                                                                                • Not Executed
                                                                                                control_flow_graph 1004 7ffd345e76f2-7ffd345e770f 1007 7ffd345e7710-7ffd345e7741 1004->1007 1010 7ffd345e7743-7ffd345e779c 1007->1010 1014 7ffd345e77e6-7ffd345e77f6 1010->1014 1015 7ffd345e779e-7ffd345e77ba 1010->1015 1022 7ffd345e77fc-7ffd345e780a 1014->1022 1023 7ffd345e77f8-7ffd345e77fa 1014->1023 1016 7ffd345e7bc8-7ffd345e7be6 call 7ffd345e0c40 * 2 1015->1016 1017 7ffd345e77c0-7ffd345e77de call 7ffd345e0c40 * 2 1015->1017 1033 7ffd345e7bec-7ffd345e7bf3 1016->1033 1034 7ffd345e7cf2-7ffd345e7cfd 1016->1034 1031 7ffd345e77e4-7ffd345e77e5 1017->1031 1032 7ffd345e7a5e-7ffd345e7a7c call 7ffd345e0c40 * 2 1017->1032 1027 7ffd345e780d-7ffd345e7822 1022->1027 1023->1027 1039 7ffd345e7828-7ffd345e784c call 7ffd345e5da0 * 2 1027->1039 1040 7ffd345e7824-7ffd345e7826 1027->1040 1031->1014 1054 7ffd345e7aa6-7ffd345e7ac4 call 7ffd345e0c40 * 2 1032->1054 1055 7ffd345e7a7e-7ffd345e7a88 1032->1055 1037 7ffd345e7c06-7ffd345e7c08 1033->1037 1038 7ffd345e7bf5-7ffd345e7c04 1033->1038 1042 7ffd345e7c0f-7ffd345e7c33 1037->1042 1038->1037 1051 7ffd345e7c0a 1038->1051 1043 7ffd345e784f-7ffd345e7864 1039->1043 1040->1043 1058 7ffd345e7c35-7ffd345e7c52 1042->1058 1059 7ffd345e7c7f-7ffd345e7caf 1042->1059 1056 7ffd345e786a-7ffd345e788e call 7ffd345e5da0 * 2 1043->1056 1057 7ffd345e7866-7ffd345e7868 1043->1057 1051->1042 1084 7ffd345e7aca-7ffd345e7ad5 1054->1084 1085 7ffd345e7b7b-7ffd345e7b86 1054->1085 1060 7ffd345e7a8a-7ffd345e7a9a 1055->1060 1061 7ffd345e7a9c 1055->1061 1062 7ffd345e7891-7ffd345e78a6 1056->1062 1057->1062 1067 7ffd345e7c58-7ffd345e7c7d 1058->1067 1068 7ffd345e7cfe-7ffd345e7d63 1058->1068 1092 7ffd345e7cb5-7ffd345e7cc4 1059->1092 1093 7ffd345e7cb1-7ffd345e7cb3 1059->1093 1070 7ffd345e7a9e-7ffd345e7a9f 1060->1070 1061->1070 1081 7ffd345e78ac-7ffd345e78c3 call 7ffd345e5da0 1062->1081 1082 7ffd345e78a8-7ffd345e78aa 1062->1082 1067->1059 1070->1054 1083 7ffd345e78d3-7ffd345e78e1 1081->1083 1082->1083 1103 7ffd345e78e7-7ffd345e78f5 1083->1103 1104 7ffd345e78e3-7ffd345e78e5 1083->1104 1101 7ffd345e7adb-7ffd345e7aea 1084->1101 1102 7ffd345e7ad7-7ffd345e7ad9 1084->1102 1105 7ffd345e7b8c-7ffd345e7b90 1085->1105 1106 7ffd345e7b88-7ffd345e7b8a 1085->1106 1098 7ffd345e7cc7-7ffd345e7cce 1092->1098 1093->1098 1099 7ffd345e7ce3-7ffd345e7ce4 1098->1099 1100 7ffd345e7cd0-7ffd345e7ce1 1098->1100 1108 7ffd345e7ce6-7ffd345e7ceb 1099->1108 1100->1108 1109 7ffd345e7aed-7ffd345e7b28 1101->1109 1102->1109 1110 7ffd345e78f8-7ffd345e7901 1103->1110 1104->1110 1116 7ffd345e7b9a-7ffd345e7b9b 1105->1116 1111 7ffd345e7b9e-7ffd345e7ba0 1106->1111 1108->1034 1118 7ffd345e7b2b-7ffd345e7b31 1109->1118 1126 7ffd345e7908-7ffd345e790f 1110->1126 1111->1034 1117 7ffd345e7ba6-7ffd345e7bb8 1111->1117 1116->1111 1117->1016 1117->1116 1121 7ffd345e7b44-7ffd345e7b4c 1118->1121 1122 7ffd345e7b33-7ffd345e7b3b 1118->1122 1123 7ffd345e7b4d-7ffd345e7b4e 1121->1123 1125 7ffd345e7b5e-7ffd345e7b79 1121->1125 1122->1123 1124 7ffd345e7b3d-7ffd345e7b42 1122->1124 1127 7ffd345e7b53-7ffd345e7b5d call 7ffd345e7460 1123->1127 1124->1127 1125->1085 1125->1118 1126->1032 1128 7ffd345e7915-7ffd345e791c 1126->1128 1127->1125 1128->1032 1130 7ffd345e7922-7ffd345e7939 1128->1130 1135 7ffd345e793b-7ffd345e794d 1130->1135 1136 7ffd345e796e-7ffd345e7979 1130->1136 1139 7ffd345e7953-7ffd345e7961 1135->1139 1140 7ffd345e794f-7ffd345e7951 1135->1140 1141 7ffd345e797b-7ffd345e797d 1136->1141 1142 7ffd345e797f-7ffd345e798e 1136->1142 1144 7ffd345e7964-7ffd345e7967 1139->1144 1140->1144 1143 7ffd345e7991-7ffd345e7993 1141->1143 1142->1143 1146 7ffd345e7999-7ffd345e79b0 1143->1146 1147 7ffd345e7a48-7ffd345e7a5a 1143->1147 1144->1136 1146->1147 1151 7ffd345e79b6-7ffd345e79d3 1146->1151 1147->1032 1154 7ffd345e79d5-7ffd345e79dd 1151->1154 1155 7ffd345e79df 1151->1155 1156 7ffd345e79e1-7ffd345e79e3 1154->1156 1155->1156 1156->1147 1157 7ffd345e79e5-7ffd345e79ef 1156->1157 1159 7ffd345e79f1-7ffd345e79fb call 7ffd345e4608 1157->1159 1160 7ffd345e79fd-7ffd345e7a05 1157->1160 1159->1032 1159->1160 1162 7ffd345e7a07-7ffd345e7a2c call 7ffd345e5c90 1160->1162 1163 7ffd345e7a33-7ffd345e7a46 call 7ffd345e5dc8 1160->1163 1162->1163 1163->1032
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: hl]4$hn]4$]/4
                                                                                                • API String ID: 0-3156483355
                                                                                                • Opcode ID: 2a3e872ef398bdd50eeacc4b40eb69a755530d371e9973e89d29e75c626bfc21
                                                                                                • Instruction ID: 127df1ef56d8a239a8a05d74a917554d4145ee179af1955af8e0723a15d4d3cf
                                                                                                • Opcode Fuzzy Hash: 2a3e872ef398bdd50eeacc4b40eb69a755530d371e9973e89d29e75c626bfc21
                                                                                                • Instruction Fuzzy Hash: 2012C521F0DA564FE79AE72884B16FA73D1EF96300F584079D25DD72D3DE2CA886A340
                                                                                                Function 00007FFD345E91D0 Relevance: 6.9, Strings: 5, Instructions: 635COMMON
                                                                                                Download Yara Rule

                                                                                                Control-flow Graph

                                                                                                • Executed
                                                                                                • Not Executed
                                                                                                control_flow_graph 633 7ffd345e91d0-7ffd345e9205 637 7ffd345e91cb 633->637 638 7ffd345e9207 633->638 637->633 639 7ffd345e9209-7ffd345e9273 638->639 640 7ffd345e9281-7ffd345e928c 638->640 642 7ffd345e92f1-7ffd345e9319 640->642 643 7ffd345e928e-7ffd345e92d4 640->643 648 7ffd345e9321-7ffd345e933e 642->648 652 7ffd345e938a-7ffd345e93d3 648->652 653 7ffd345e9340-7ffd345e934b 648->653 661 7ffd345e93d9-7ffd345e940a call 7ffd345e8d28 652->661 662 7ffd345eaff7-7ffd345eb00c call 7ffd345eb5c5 652->662 658 7ffd345e934d-7ffd345e935d 653->658 659 7ffd345e92de-7ffd345e92ec 653->659 663 7ffd345e9363-7ffd345e9388 658->663 664 7ffd345eb2f2-7ffd345eb2f3 658->664 659->642 678 7ffd345e940c-7ffd345e941c 661->678 679 7ffd345e9420-7ffd345e942a 661->679 671 7ffd345eb22c-7ffd345eb242 662->671 672 7ffd345eb012-7ffd345eb07b 662->672 663->652 668 7ffd345eb2f9-7ffd345eb2fa 664->668 673 7ffd345eb2fb-7ffd345eb2fc 668->673 676 7ffd345eb244-7ffd345eb261 671->676 677 7ffd345eb28e-7ffd345eb2ae 671->677 708 7ffd345eb082-7ffd345eb09d call 7ffd345e8e18 672->708 684 7ffd345eb303 673->684 689 7ffd345eb267-7ffd345eb28c 676->689 690 7ffd345eb304-7ffd345eb30c 676->690 691 7ffd345eb2b9-7ffd345eb2ba 677->691 678->679 686 7ffd345e942b 679->686 687 7ffd345e942c-7ffd345e94c3 call 7ffd345e5dc8 679->687 684->690 686->687 732 7ffd345e94eb-7ffd345e94ec 687->732 733 7ffd345e94c5-7ffd345e94e9 687->733 689->677 697 7ffd345eb2c2-7ffd345eb2cf 691->697 697->668 699 7ffd345eb2d1-7ffd345eb2d9 697->699 699->684 702 7ffd345eb2db-7ffd345eb2f1 699->702 713 7ffd345eb0a2-7ffd345eb0b8 708->713 714 7ffd345eb0ba-7ffd345eb0c5 713->714 715 7ffd345eb104-7ffd345eb12f call 7ffd345e8080 713->715 719 7ffd345eb0c8-7ffd345eb0d7 714->719 720 7ffd345eb0e5-7ffd345eb0ed 714->720 727 7ffd345eb173-7ffd345eb174 715->727 728 7ffd345eb131-7ffd345eb137 715->728 719->673 725 7ffd345eb0dd-7ffd345eb0ed 719->725 724 7ffd345eb0ef-7ffd345eb102 720->724 724->715 725->724 734 7ffd345eb17b-7ffd345eb1a9 727->734 730 7ffd345eb169-7ffd345eb171 728->730 731 7ffd345eb139-7ffd345eb153 call 7ffd345e0ba0 * 2 728->731 730->734 746 7ffd345eb155-7ffd345eb15d 731->746 747 7ffd345eb15f-7ffd345eb167 731->747 738 7ffd345e94f1-7ffd345e9537 732->738 733->738 748 7ffd345eb1ab-7ffd345eb1b6 734->748 749 7ffd345eb208-7ffd345eb217 734->749 738->662 746->734 747->734 753 7ffd345eb22b 748->753 754 7ffd345eb1b8-7ffd345eb207 748->754 750 7ffd345eb219-7ffd345eb227 call 7ffd345e8e28 749->750 750->671 753->671 754->749
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: 8\/4$H*h4$P-h4$Pu^4$X(h4
                                                                                                • API String ID: 0-1513425561
                                                                                                • Opcode ID: b597ecfc2982fefd05a5fe90724cfc7463972169e303a94932234c397c9b2bea
                                                                                                • Instruction ID: 618564a0c9ed1f6265a1326678295ae4453de1787de6a3ac71880e1aea3fd53b
                                                                                                • Opcode Fuzzy Hash: b597ecfc2982fefd05a5fe90724cfc7463972169e303a94932234c397c9b2bea
                                                                                                • Instruction Fuzzy Hash: 2222E231F1DA4A4FEB95EB2888A56F977E1EF56300F4800B9D44DD7293DE2DAC829740
                                                                                                Function 00007FFD345E5669 Relevance: 4.2, Strings: 3, Instructions: 408COMMON
                                                                                                Download Yara Rule

                                                                                                Control-flow Graph

                                                                                                • Executed
                                                                                                • Not Executed
                                                                                                control_flow_graph 1170 7ffd345e5669-7ffd345e569a 1173 7ffd345e5729-7ffd345e5732 1170->1173 1174 7ffd345e56a0-7ffd345e56bb 1170->1174 1176 7ffd345e56d4-7ffd345e56e9 1174->1176 1177 7ffd345e56bd-7ffd345e56d2 1174->1177 1180 7ffd345e56eb-7ffd345e5726 1176->1180 1181 7ffd345e5733-7ffd345e5772 1176->1181 1177->1176 1180->1173 1188 7ffd345e57bc-7ffd345e57bf 1181->1188 1189 7ffd345e5774-7ffd345e578b 1181->1189 1191 7ffd345e583b 1188->1191 1192 7ffd345e57c1 1188->1192 1193 7ffd345e59a8-7ffd345e59ba 1189->1193 1194 7ffd345e5791-7ffd345e5797 1189->1194 1195 7ffd345e583c-7ffd345e5846 1191->1195 1196 7ffd345e5807-7ffd345e5814 1192->1196 1197 7ffd345e57c3-7ffd345e57cb 1192->1197 1194->1193 1199 7ffd345e579d-7ffd345e57a3 1194->1199 1206 7ffd345e5848 1195->1206 1200 7ffd345e5817-7ffd345e582b 1196->1200 1197->1195 1198 7ffd345e57cd-7ffd345e57cf 1197->1198 1202 7ffd345e584b-7ffd345e5854 1198->1202 1203 7ffd345e57d1 1198->1203 1199->1193 1204 7ffd345e57a9-7ffd345e57af 1199->1204 1210 7ffd345e582c-7ffd345e583a 1200->1210 1208 7ffd345e5856-7ffd345e585a 1202->1208 1203->1200 1207 7ffd345e57d3-7ffd345e57d7 1203->1207 1204->1193 1209 7ffd345e57b5-7ffd345e57bb 1204->1209 1206->1202 1207->1206 1211 7ffd345e57d9-7ffd345e57de 1207->1211 1212 7ffd345e585f-7ffd345e5868 1208->1212 1209->1188 1209->1210 1210->1191 1211->1212 1213 7ffd345e57e0-7ffd345e57e5 1211->1213 1215 7ffd345e586d-7ffd345e5888 1212->1215 1213->1208 1214 7ffd345e57e7-7ffd345e57ec 1213->1214 1214->1215 1216 7ffd345e57ee-7ffd345e5802 1214->1216 1215->1193 1220 7ffd345e588e-7ffd345e5894 1215->1220 1216->1193 1216->1196 1220->1193 1221 7ffd345e589a-7ffd345e58a0 1220->1221 1221->1193 1222 7ffd345e58a6-7ffd345e58ac 1221->1222 1222->1193 1223 7ffd345e58b2-7ffd345e5932 1222->1223 1223->1193 1231 7ffd345e5934-7ffd345e5949 call 7ffd345e48a8 1223->1231 1234 7ffd345e594e-7ffd345e5950 1231->1234 1234->1193 1235 7ffd345e5952-7ffd345e596e call 7ffd345e48a8 1234->1235 1235->1193 1239 7ffd345e5970-7ffd345e5978 1235->1239 1239->1193 1240 7ffd345e597a-7ffd345e59a7 call 7ffd345e48a8 1239->1240
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: P'.4$0]4$2]4
                                                                                                • API String ID: 0-24047320
                                                                                                • Opcode ID: a9fb91566b7051aaa7a8a68f7fa4aa8a4a70944e91199b44f5f583b3c442e7c6
                                                                                                • Instruction ID: 3b0cd99f2473e66f5196e8617be87f6712ea30f49deca057e650925932ca41b8
                                                                                                • Opcode Fuzzy Hash: a9fb91566b7051aaa7a8a68f7fa4aa8a4a70944e91199b44f5f583b3c442e7c6
                                                                                                • Instruction Fuzzy Hash: D5C10732E0C94A4BEBA6EE5884A28F633D1EF52310B58057AD55EC7583ED1DF887C781
                                                                                                Function 00007FFD345EAED6 Relevance: 4.1, Strings: 3, Instructions: 382COMMON
                                                                                                Download Yara Rule

                                                                                                Control-flow Graph

                                                                                                • Executed
                                                                                                • Not Executed
                                                                                                control_flow_graph 1244 7ffd345eaed6-7ffd345eaff1 1263 7ffd345e93d9-7ffd345e940a call 7ffd345e8d28 1244->1263 1264 7ffd345eaff7-7ffd345eb00c call 7ffd345eb5c5 1244->1264 1274 7ffd345e940c-7ffd345e941c 1263->1274 1275 7ffd345e9420-7ffd345e942a 1263->1275 1269 7ffd345eb22c-7ffd345eb242 1264->1269 1270 7ffd345eb012-7ffd345eb0b8 call 7ffd345e8e18 1264->1270 1272 7ffd345eb244-7ffd345eb261 1269->1272 1273 7ffd345eb28e-7ffd345eb2ba 1269->1273 1311 7ffd345eb0ba-7ffd345eb0c5 1270->1311 1312 7ffd345eb104-7ffd345eb12f call 7ffd345e8080 1270->1312 1283 7ffd345eb267-7ffd345eb28c 1272->1283 1284 7ffd345eb304-7ffd345eb30c 1272->1284 1291 7ffd345eb2c2-7ffd345eb2cf 1273->1291 1274->1275 1280 7ffd345e942b 1275->1280 1281 7ffd345e942c-7ffd345e94c3 call 7ffd345e5dc8 1275->1281 1280->1281 1329 7ffd345e94eb-7ffd345e94ec 1281->1329 1330 7ffd345e94c5-7ffd345e94e9 1281->1330 1283->1273 1293 7ffd345eb2f9-7ffd345eb2fa 1291->1293 1294 7ffd345eb2d1-7ffd345eb2d9 1291->1294 1299 7ffd345eb2fb-7ffd345eb2fc 1293->1299 1297 7ffd345eb2db-7ffd345eb2f1 1294->1297 1298 7ffd345eb303 1294->1298 1298->1284 1299->1298 1316 7ffd345eb0c8-7ffd345eb0d7 1311->1316 1317 7ffd345eb0e5-7ffd345eb0ed 1311->1317 1324 7ffd345eb173-7ffd345eb174 1312->1324 1325 7ffd345eb131-7ffd345eb137 1312->1325 1316->1299 1322 7ffd345eb0dd-7ffd345eb0ed 1316->1322 1321 7ffd345eb0ef-7ffd345eb102 1317->1321 1321->1312 1322->1321 1331 7ffd345eb17b-7ffd345eb1a9 1324->1331 1327 7ffd345eb169-7ffd345eb171 1325->1327 1328 7ffd345eb139-7ffd345eb153 call 7ffd345e0ba0 * 2 1325->1328 1327->1331 1343 7ffd345eb155-7ffd345eb15d 1328->1343 1344 7ffd345eb15f-7ffd345eb167 1328->1344 1335 7ffd345e94f1-7ffd345e9537 1329->1335 1330->1335 1345 7ffd345eb1ab-7ffd345eb1b6 1331->1345 1346 7ffd345eb208-7ffd345eb227 call 7ffd345e8e28 1331->1346 1335->1264 1343->1331 1344->1331 1350 7ffd345eb22b 1345->1350 1351 7ffd345eb1b8-7ffd345eb207 1345->1351 1346->1269 1350->1269 1351->1346
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: H*h4$Pu^4$X(h4
                                                                                                • API String ID: 0-552900873
                                                                                                • Opcode ID: f42272682c71085ef7e3256dd71aaa4d89a9f811eaa7231ddec4292a4513a81d
                                                                                                • Instruction ID: 20113e5d0de44bfc6c992c012a30a9ca0621e4f8e587efbad6ff274db631e5b7
                                                                                                • Opcode Fuzzy Hash: f42272682c71085ef7e3256dd71aaa4d89a9f811eaa7231ddec4292a4513a81d
                                                                                                • Instruction Fuzzy Hash: E6C1A131F1D94A8FEB95EB2C84A5BBA73D1EF99300F1841B9D00DD7297CD29AC829741
                                                                                                Function 00007FFD345E6885 Relevance: 4.0, Strings: 3, Instructions: 204COMMON
                                                                                                Download Yara Rule

                                                                                                Control-flow Graph

                                                                                                • Executed
                                                                                                • Not Executed
                                                                                                control_flow_graph 1434 7ffd345e6885-7ffd345e68fd 1437 7ffd345e6b61-7ffd345e6b68 1434->1437 1438 7ffd345e6903-7ffd345e690a 1434->1438 1439 7ffd345e72fe-7ffd345e7311 1437->1439 1440 7ffd345e6b6e-7ffd345e6b75 1437->1440 1438->1437 1441 7ffd345e6910-7ffd345e6913 1438->1441 1440->1439 1442 7ffd345e6b7b-7ffd345e6b8d 1440->1442 1443 7ffd345e691c-7ffd345e692a 1441->1443 1444 7ffd345e6915-7ffd345e6917 1441->1444 1445 7ffd345e6bd9-7ffd345e6be3 1442->1445 1446 7ffd345e6b8f-7ffd345e6bac 1442->1446 1455 7ffd345e692c 1443->1455 1456 7ffd345e692e 1443->1456 1447 7ffd345e69ca-7ffd345e69cd 1444->1447 1448 7ffd345e6be5-7ffd345e6bec 1445->1448 1453 7ffd345e6bb2-7ffd345e6bd7 1446->1453 1454 7ffd345e733f-7ffd345e7383 1446->1454 1451 7ffd345e69d6-7ffd345e69e4 1447->1451 1452 7ffd345e69cf-7ffd345e69d1 1447->1452 1460 7ffd345e6bf3-7ffd345e6bfe 1448->1460 1471 7ffd345e69e6 1451->1471 1472 7ffd345e69e8 1451->1472 1457 7ffd345e6a85-7ffd345e6a8b 1452->1457 1453->1445 1461 7ffd345e6930-7ffd345e6933 1455->1461 1456->1461 1458 7ffd345e6a91-7ffd345e6a93 1457->1458 1459 7ffd345e6b3d-7ffd345e6b3f 1457->1459 1458->1459 1463 7ffd345e6a99-7ffd345e6b3b 1458->1463 1459->1437 1464 7ffd345e6b41-7ffd345e6b49 1459->1464 1465 7ffd345e6ca1-7ffd345e6ca7 1460->1465 1466 7ffd345e6c04-7ffd345e6c1c 1460->1466 1469 7ffd345e6935-7ffd345e693b 1461->1469 1470 7ffd345e693d-7ffd345e6948 1461->1470 1463->1437 1464->1437 1478 7ffd345e6b4b-7ffd345e6b5d 1464->1478 1465->1439 1473 7ffd345e6cad-7ffd345e6cb5 1465->1473 1466->1465 1495 7ffd345e6c22-7ffd345e6c84 1466->1495 1480 7ffd345e69b8-7ffd345e69c8 1469->1480 1474 7ffd345e694a-7ffd345e6992 1470->1474 1475 7ffd345e6994-7ffd345e69b5 1470->1475 1476 7ffd345e69ea-7ffd345e69ed 1471->1476 1472->1476 1481 7ffd345e6cb7-7ffd345e6cf6 1473->1481 1482 7ffd345e6cfd-7ffd345e6d05 1473->1482 1474->1475 1475->1480 1484 7ffd345e69f7-7ffd345e6a02 1476->1484 1485 7ffd345e69ef-7ffd345e69f5 1476->1485 1480->1447 1481->1482 1482->1439 1497 7ffd345e6d0b-7ffd345e6d80 1482->1497 1492 7ffd345e6a04-7ffd345e6a21 1484->1492 1493 7ffd345e6a4e-7ffd345e6a70 1484->1493 1491 7ffd345e6a73-7ffd345e6a83 1485->1491 1491->1457 1506 7ffd345e7336-7ffd345e733e 1492->1506 1507 7ffd345e6a27-7ffd345e6a4c 1492->1507 1493->1491 1495->1465 1506->1454 1507->1493
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: PM-4$XM-4$h4]4
                                                                                                • API String ID: 0-3641305040
                                                                                                • Opcode ID: 49b88b011a512748f5d3082de534bc8f34c1822e07da25d9236ac716121865a7
                                                                                                • Instruction ID: 96df6ac05ade596e21237311d9d1a9097e9778bccb9cd4986a7f99c9e207af01
                                                                                                • Opcode Fuzzy Hash: 49b88b011a512748f5d3082de534bc8f34c1822e07da25d9236ac716121865a7
                                                                                                • Instruction Fuzzy Hash: 36515662F1EA864BEBAAEA1C44A52F633C1EF56344F58447ED54EC72D2DD2CF8819340
                                                                                                Function 00007FFD342D8014 Relevance: 1.7, APIs: 1, Instructions: 178COMMON
                                                                                                Download Yara Rule
                                                                                                APIs
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3409638077.00007FFD342D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD342D0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd342d0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID: MitigationPolicyProcess
                                                                                                • String ID:
                                                                                                • API String ID: 1088084561-0
                                                                                                • Opcode ID: 33f0b110c59317cedf876ee7b8220c2e600c15ecedaf4787d9cdbdaff1d605f8
                                                                                                • Instruction ID: 2c33314bb3184cc15b1d10a5c85caf44cafe028174b85758e4cede5e017606d9
                                                                                                • Opcode Fuzzy Hash: 33f0b110c59317cedf876ee7b8220c2e600c15ecedaf4787d9cdbdaff1d605f8
                                                                                                • Instruction Fuzzy Hash: B8517A31E0DB494FDB24AFA8884A5F97BE0EF56310F04017FE499D3192DF68A846C791
                                                                                                Function 00007FFD345E92D6 Relevance: 1.5, Strings: 1, Instructions: 229COMMON
                                                                                                Download Yara Rule
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: 8\/4
                                                                                                • API String ID: 0-1121260638
                                                                                                • Opcode ID: 12d9d7dc0e5073437f29825b4cc159723d5be43cb235b18036f55fbb8d7971e1
                                                                                                • Instruction ID: 1b2a8dcf4c9c3544b750daccf1a123e6c554dcd4b4deacff4a5ea76207471719
                                                                                                • Opcode Fuzzy Hash: 12d9d7dc0e5073437f29825b4cc159723d5be43cb235b18036f55fbb8d7971e1
                                                                                                • Instruction Fuzzy Hash: EA71E371F19A494FEB95DB2888A46F977E1FF5A300F5400B9D09DD3292DE39A881DB00
                                                                                                Function 00007FFD345E26C9 Relevance: 1.5, Strings: 1, Instructions: 209COMMON
                                                                                                Download Yara Rule
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: M-4
                                                                                                • API String ID: 0-4171940075
                                                                                                • Opcode ID: 963a1e8712fee6a056c4802465cd6e052aff0bfa358b31954814f3664d2bcee1
                                                                                                • Instruction ID: 3de7615b133e94ef24a6f6399867b6da423e061ffb52a94ae8f6c9a7b79a0996
                                                                                                • Opcode Fuzzy Hash: 963a1e8712fee6a056c4802465cd6e052aff0bfa358b31954814f3664d2bcee1
                                                                                                • Instruction Fuzzy Hash: 4061A472F1D9894FEF99DE2884A1AA637D1FF65304B0800BDD49ED7286DE28F846C740
                                                                                                Function 00007FFD345E7E7D Relevance: 1.4, Strings: 1, Instructions: 157COMMON
                                                                                                Download Yara Rule
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: `j/4
                                                                                                • API String ID: 0-1821026865
                                                                                                • Opcode ID: f8e7d2eeb20552a65e65bf7599bee831878a8ffa518b52e02a06513f98ab602d
                                                                                                • Instruction ID: 891b0ffd8a757039e3c12acfdee94df302b6bb9b4f32252412443ff8f502afda
                                                                                                • Opcode Fuzzy Hash: f8e7d2eeb20552a65e65bf7599bee831878a8ffa518b52e02a06513f98ab602d
                                                                                                • Instruction Fuzzy Hash: 0041A221F0DA564FEB9AD72854B06FA77D1EF47250F0C40B9C59ECB1D2CE1CA886A311
                                                                                                Function 00007FFD345ED772 Relevance: 1.3, Strings: 1, Instructions: 95COMMON
                                                                                                Download Yara Rule
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: _
                                                                                                • API String ID: 0-701932520
                                                                                                • Opcode ID: 891f84cf470bdf678bc8ec7d7884917514acc9e530483c9e880a1297b6d8583c
                                                                                                • Instruction ID: dd2a0d44620374aad5a689405d74ed5c53c8364109de8f0d6c2977f339a1078f
                                                                                                • Opcode Fuzzy Hash: 891f84cf470bdf678bc8ec7d7884917514acc9e530483c9e880a1297b6d8583c
                                                                                                • Instruction Fuzzy Hash: 6731E821E08A074BF75AE72884A63FA36D1EF56310F58447BC54DE72D2ED2CA8899351
                                                                                                Function 00007FFD345E515D Relevance: .3, Instructions: 324COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 919712fceb89b0fde755f7e25e601b3a1eaf0c1af4013f57fc6ba949cf18b4be
                                                                                                • Instruction ID: 3990779c0d4ef9cc377e7d44bc8223647e8273a53214b852430593e8f00e2206
                                                                                                • Opcode Fuzzy Hash: 919712fceb89b0fde755f7e25e601b3a1eaf0c1af4013f57fc6ba949cf18b4be
                                                                                                • Instruction Fuzzy Hash: DCB1AF34609B098FDBDDEF18C0A4AA573E1FF69305B6509ADD059CF697CA25F842CB40
                                                                                                Function 00007FFD345E3EA8 Relevance: .3, Instructions: 271COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 2dab36627b388b94d27419c16388f548943120df3f9b0920332be38262fb533d
                                                                                                • Instruction ID: 15935102dc4ab007594bb661824e8a4f7be62b06cd9292360672283e38466786
                                                                                                • Opcode Fuzzy Hash: 2dab36627b388b94d27419c16388f548943120df3f9b0920332be38262fb533d
                                                                                                • Instruction Fuzzy Hash: 5E912535B0DA498FDBDDEF18C0A16A573E1FFA930472445B9C059CF68BCA29E886C740
                                                                                                Function 00007FFD345ED27E Relevance: .3, Instructions: 262COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 8bfdaeac3b092150f6a290a5fa0f59a383ce8d6a7559d80a26ca498a0fea51b5
                                                                                                • Instruction ID: 72c0b51b56721747d2c05c1c69ea3bf5ba74ec44ace47c2e8720ceccfe94fa28
                                                                                                • Opcode Fuzzy Hash: 8bfdaeac3b092150f6a290a5fa0f59a383ce8d6a7559d80a26ca498a0fea51b5
                                                                                                • Instruction Fuzzy Hash: 27A1DF70E586164BEB49EB54C8A17FD36A1FB86301F54407DE14AE32C2CE3CA882CB11
                                                                                                Function 00007FFD345EC527 Relevance: .2, Instructions: 236COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 9c344cfb7ec0fade228af9ed2d9c31ccd22f34cdef9017dee909f017b40e9064
                                                                                                • Instruction ID: 27de2daa765cffa26cc7494d383b9400f28cff4be2bd4ad3a95505b86b4ba38a
                                                                                                • Opcode Fuzzy Hash: 9c344cfb7ec0fade228af9ed2d9c31ccd22f34cdef9017dee909f017b40e9064
                                                                                                • Instruction Fuzzy Hash: A0614852F0D98A4FE793EA6C58B91FA7BD0EF9A250B4801B7D14DC7183DD0CA8869381
                                                                                                Function 00007FFD345E78C7 Relevance: .2, Instructions: 230COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 3a9ad44c443504dc15b3aff302e623b94d6b9bdc27f99b2d8517d81747755c9c
                                                                                                • Instruction ID: 95e523b3a3a2a17f98659c46bf64e0863555aa060b9bc57674437a5034c599cf
                                                                                                • Opcode Fuzzy Hash: 3a9ad44c443504dc15b3aff302e623b94d6b9bdc27f99b2d8517d81747755c9c
                                                                                                • Instruction Fuzzy Hash: 9A718935F199174BEB9AD62880F16FF72D2EF96305F584439D15ED32C1EE2DB882A240
                                                                                                Function 00007FFD345E4B1D Relevance: .2, Instructions: 187COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 8726fd1867acce9d0e72b9e12fa4c580cc3260ba47c1b29b0d026f89bc19d742
                                                                                                • Instruction ID: b7da85755f57eea029ce620c4017d8111f76c83f5ac55bb2eca42a06b308d40a
                                                                                                • Opcode Fuzzy Hash: 8726fd1867acce9d0e72b9e12fa4c580cc3260ba47c1b29b0d026f89bc19d742
                                                                                                • Instruction Fuzzy Hash: E3514832E0DA850FE796DB7888A96F67BE0EF9B311B0C01BAD44DD7192DE1DA845C341
                                                                                                Function 00007FFD345E6744 Relevance: .2, Instructions: 173COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 7dc32561993afedb7186214c4a1f3aaa61383397d793ef9eceba3b73966b6135
                                                                                                • Instruction ID: 2f2ab15624568603f3a8585844db79c9d034a55f73aec2fab2b7bb0b25ecb2f7
                                                                                                • Opcode Fuzzy Hash: 7dc32561993afedb7186214c4a1f3aaa61383397d793ef9eceba3b73966b6135
                                                                                                • Instruction Fuzzy Hash: 8D512211F0E6870EFBABAA6864B12FA37919F47314F5841B9D44ECA1D3CE1CA886D241
                                                                                                Function 00007FFD345E6089 Relevance: .1, Instructions: 141COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: f6f4a6dbe792f0916bc5832d3d9d44692aff08e7168e7ce1621a045f623bb151
                                                                                                • Instruction ID: ba630d847f31adc893000c3352e9298d6c1b05140415b96d64f9993d8d63ca3c
                                                                                                • Opcode Fuzzy Hash: f6f4a6dbe792f0916bc5832d3d9d44692aff08e7168e7ce1621a045f623bb151
                                                                                                • Instruction Fuzzy Hash: 13419471B09A494FDB89DF28C8A4AA63791FF9A304B5401ADD45EC72D2CB35E852CB01
                                                                                                Function 00007FFD345E4401 Relevance: .1, Instructions: 131COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 75fc29a142c200df7892f980d178cc3bde71ea45a4ed749a00c624dc741e5467
                                                                                                • Instruction ID: 7d75a56fde76d31e78f0f510a2700f23a45201a56980b35e103e886545b905d8
                                                                                                • Opcode Fuzzy Hash: 75fc29a142c200df7892f980d178cc3bde71ea45a4ed749a00c624dc741e5467
                                                                                                • Instruction Fuzzy Hash: CD311312F09C4A1FEB9AEA1C44A56F623D1EFAA345B0C017BD11DC72D7DD1CAC829340
                                                                                                Function 00007FFD345E4B40 Relevance: .1, Instructions: 116COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: c8338cf0ca2c640d2f9492f48be03ec719960040c387c616c1eb5fbdef2ad1d5
                                                                                                • Instruction ID: b3311a74fcc048c18eab67f1ca157e8cdcb663bf4c6139232d12c5ab24215e51
                                                                                                • Opcode Fuzzy Hash: c8338cf0ca2c640d2f9492f48be03ec719960040c387c616c1eb5fbdef2ad1d5
                                                                                                • Instruction Fuzzy Hash: 5C313A31A0DD450FE795EB3888A96F2B7D0FF9A315B0801BED84DD72A1DE19AC84C341
                                                                                                Function 00007FFD345EDA99 Relevance: .1, Instructions: 100COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 5664d523cb253c39031e5526f1437aff4c8bcc92299bc6ec5779e57b99995632
                                                                                                • Instruction ID: 91cea9742ed1735dba4c0d512cdd9f306617dd9170279ab3ba9020211f98f665
                                                                                                • Opcode Fuzzy Hash: 5664d523cb253c39031e5526f1437aff4c8bcc92299bc6ec5779e57b99995632
                                                                                                • Instruction Fuzzy Hash: 8531E470A0861C8FEB44DF9CC8497EDBBF0FB55311F0041AED049D3251CA74A845CB41
                                                                                                Function 00007FFD345EC0FD Relevance: .1, Instructions: 95COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: c5c19687ceb9f243ee6cd7825f381e8f2e6e97be06fa15df87c6ee059659280b
                                                                                                • Instruction ID: c830a8c4fea53d6dda30220cbd6d6f32c3bdf4515ee3dbb6b8f5cc90e2c19ff6
                                                                                                • Opcode Fuzzy Hash: c5c19687ceb9f243ee6cd7825f381e8f2e6e97be06fa15df87c6ee059659280b
                                                                                                • Instruction Fuzzy Hash: 4A21F222F1D6864FE75BE73844E91B53BE1AF6721171C01FAC28DCB193ED1EA485A701
                                                                                                Function 00007FFD345E4E89 Relevance: .1, Instructions: 87COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: bda57b049d258fec72116bc3902e52fb6cd5541d42e47dd3e1d36782c7b30b1f
                                                                                                • Instruction ID: c67bb3cad0d0166d34dd916d7dd0379f1b551f53c5ebe725b9caf6da92381600
                                                                                                • Opcode Fuzzy Hash: bda57b049d258fec72116bc3902e52fb6cd5541d42e47dd3e1d36782c7b30b1f
                                                                                                • Instruction Fuzzy Hash: 9F21B022B1DA4A0FD7A5EB6C98A12B5B7D1FF5A310B4901BAD54DC7283ED19A8808352
                                                                                                Function 00007FFD345ED8ED Relevance: .1, Instructions: 80COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 1f90b616f69dbad28d08e5410806b07165c45949e0f833e0dd3efd2b2812d7e2
                                                                                                • Instruction ID: 47942146af2dabaf0ec44a31e1da190d608eaa96c8a906ea3008971558b63510
                                                                                                • Opcode Fuzzy Hash: 1f90b616f69dbad28d08e5410806b07165c45949e0f833e0dd3efd2b2812d7e2
                                                                                                • Instruction Fuzzy Hash: D621F971A159599FDBA5EB18CCA8AD8B3F1EF59700F4401E9940DE72A2CE38ADC1DB00
                                                                                                Function 00007FFD345ED2DC Relevance: .1, Instructions: 78COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: b446f47314a76ef631b817fbc47a7a23688c5fa742b141cb6da3f9a0a35ad74e
                                                                                                • Instruction ID: a807f290252a554ac1b866cb98debb8ce0a110a4fd8fed9784db6cccee0f6ba2
                                                                                                • Opcode Fuzzy Hash: b446f47314a76ef631b817fbc47a7a23688c5fa742b141cb6da3f9a0a35ad74e
                                                                                                • Instruction Fuzzy Hash: 37318B70E056064FE74AEB65C4B13EE36A1EB46312F44407ED24AE73D2DE3CA5829B12
                                                                                                Function 00007FFD345E3A65 Relevance: .1, Instructions: 76COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: ac14ff2f0591173bb239f44d1297aaac2e9e9054933a3ccbe97238fe89e834ba
                                                                                                • Instruction ID: 28729fc0bcc71e2d6a237d10b72556ae66836bb5f2626ab8032d94f5ec6d4378
                                                                                                • Opcode Fuzzy Hash: ac14ff2f0591173bb239f44d1297aaac2e9e9054933a3ccbe97238fe89e834ba
                                                                                                • Instruction Fuzzy Hash: B621E23154E2D95FC303ABA8D8649D63FB8EF8721470901E7E089CB0B3C51D998BC7A2
                                                                                                Function 00007FFD345E5DD4 Relevance: .1, Instructions: 71COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: f07d17e43ccbd2854d47a2ed34615906f34adced78f17e914bfbf3d1c7decabf
                                                                                                • Instruction ID: 7cbceb91b87583340314ef4e34e0c64afcf9a013f25aa20cfd37ce40157fcdf4
                                                                                                • Opcode Fuzzy Hash: f07d17e43ccbd2854d47a2ed34615906f34adced78f17e914bfbf3d1c7decabf
                                                                                                • Instruction Fuzzy Hash: 65114882F2D99A0AFBD6EB6C14F65F616D0FF96200B9840B6D14CC7187DC1CE8815351
                                                                                                Function 00007FFD345E5F1D Relevance: .1, Instructions: 71COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: d9e098b955817a5acb4af7216f9738f02b51bbb47832fd93d44b46e0d42aec6d
                                                                                                • Instruction ID: fb49967706941985a15ae9effa7cfb8f2471f17e3cc0583741675860ad43e294
                                                                                                • Opcode Fuzzy Hash: d9e098b955817a5acb4af7216f9738f02b51bbb47832fd93d44b46e0d42aec6d
                                                                                                • Instruction Fuzzy Hash: E51175B6E0DE4C4FDFD5DF9458E11EE7FA0EF56304B18009AE5A9D3192DA24A845C702
                                                                                                Function 00007FFD345E1342 Relevance: .1, Instructions: 63COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 884865d556fd08e704507a618e1ff4326bfe18e9aba53e2367e9c8ff1d4a9e91
                                                                                                • Instruction ID: d107f324a8d5429e57a792def00d9e53c201f24068711d8bc35b39f085488b92
                                                                                                • Opcode Fuzzy Hash: 884865d556fd08e704507a618e1ff4326bfe18e9aba53e2367e9c8ff1d4a9e91
                                                                                                • Instruction Fuzzy Hash: 5B113A3BE0D6456BD722EB3CE4A14D7BBA0FF07328B0800BBD189C6052DA29748AD751
                                                                                                Function 00007FFD345E4DF9 Relevance: .1, Instructions: 61COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 2c609dd72945d8da7e7bd71805bfdfcd7f1cbc27770562c86afcd193136ac2b5
                                                                                                • Instruction ID: 6fabbd2f0fd118cad399e1c87f2531c18d25d7153707f18f4c9db6942608cee9
                                                                                                • Opcode Fuzzy Hash: 2c609dd72945d8da7e7bd71805bfdfcd7f1cbc27770562c86afcd193136ac2b5
                                                                                                • Instruction Fuzzy Hash: 9911E315F0DA870BE76AD32845F03B66AE1EF87201F0D80BAC599C61D2CD1DACC09342
                                                                                                Function 00007FFD345E27F7 Relevance: .1, Instructions: 61COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 6ac6c8f7cb7d2ab8d48d068538bb23a53366f69df582eee2cd4f6e30ee5fd4d0
                                                                                                • Instruction ID: 4477ffeed4661f608d7f4439b7643ed6db30460537141c953fadf454dac721a9
                                                                                                • Opcode Fuzzy Hash: 6ac6c8f7cb7d2ab8d48d068538bb23a53366f69df582eee2cd4f6e30ee5fd4d0
                                                                                                • Instruction Fuzzy Hash: 05116361F08A494FDB99EF18C4A1BA577D1FF59304F1840A9D48DDB287CE29E8868B41
                                                                                                Function 00007FFD345E2860 Relevance: .1, Instructions: 60COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: fc23e25e290266e2cef6ce8f17f09169658ff202325ab9f33e8042671bdbd558
                                                                                                • Instruction ID: dd4fa5e806466ec6c094c6c370a954177c4333d415f5ee5a104a5d4afa14e7ea
                                                                                                • Opcode Fuzzy Hash: fc23e25e290266e2cef6ce8f17f09169658ff202325ab9f33e8042671bdbd558
                                                                                                • Instruction Fuzzy Hash: 2B118261B089494FDB89EF28C4A1BA577D1FF59304F0840ACD48DDB287CE39E8868B80
                                                                                                Function 00007FFD345E4AA0 Relevance: .1, Instructions: 60COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 134460c551743170e20633e6d3bd009da533d478072dd08c01e260fdca5d67c6
                                                                                                • Instruction ID: 394db5336cdbf505afe1ad16ee881f47ddb61c090b386096afc1b775a60f16bc
                                                                                                • Opcode Fuzzy Hash: 134460c551743170e20633e6d3bd009da533d478072dd08c01e260fdca5d67c6
                                                                                                • Instruction Fuzzy Hash: 4701D630B0CD084FDAD4EA2CD8687B677D1EFD9326F58057ED84DD32A4DA16A880C301
                                                                                                Function 00007FFD345E1138 Relevance: .1, Instructions: 58COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 389fbeca27460f2f0088de673819e1fc29208b1168fb214c88ba7e44d8e96ff6
                                                                                                • Instruction ID: d48263c9f6207cdae86f799e5ce491b35577b48bb343257fae74916cd77cc4a0
                                                                                                • Opcode Fuzzy Hash: 389fbeca27460f2f0088de673819e1fc29208b1168fb214c88ba7e44d8e96ff6
                                                                                                • Instruction Fuzzy Hash: A8016852F2981E0AEBD5EB6D14E56FA12C1FF95200B9840B9E00DC318ADC2CD8819290
                                                                                                Function 00007FFD345E4A85 Relevance: .1, Instructions: 56COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: fdef1193dca36c8a36d26c14229e5dfdae24b6ae0f85ebd4115c09afeb47b0b5
                                                                                                • Instruction ID: 8981127f3ef328dfc6e24cb93c419402dc6478f7b871f0665ae0e75582c5efb7
                                                                                                • Opcode Fuzzy Hash: fdef1193dca36c8a36d26c14229e5dfdae24b6ae0f85ebd4115c09afeb47b0b5
                                                                                                • Instruction Fuzzy Hash: 3C01FE31A0DB840FD7C2D63858641F57FE1EF97225B0D01EBD488C75A2DA195940C345
                                                                                                Function 00007FFD345E4F5A Relevance: .1, Instructions: 55COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 2248b73a548e09b0fb33037f9ef97e9816cd9b8cebf7fcbf873cde8ab1e2c974
                                                                                                • Instruction ID: 31a912e01be621e0cc4f7702a2cc5a0b548bad07754b0115dc6c0ae26d00d361
                                                                                                • Opcode Fuzzy Hash: 2248b73a548e09b0fb33037f9ef97e9816cd9b8cebf7fcbf873cde8ab1e2c974
                                                                                                • Instruction Fuzzy Hash: 7201F411E0DA950FEB5B977C5869AE67FD1DF57311B0C41EAD448CB2A3DA0CACCA8381
                                                                                                Function 00007FFD345ECCED Relevance: .0, Instructions: 49COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 5830583b96d494f93faee27aca87cc729ab9c3521aef8ecc692f0d9539f7f1c4
                                                                                                • Instruction ID: 7d08bcd4d1dac1f01760f8d00db9b73e11a670a4eab7213f8cb2abec0e674436
                                                                                                • Opcode Fuzzy Hash: 5830583b96d494f93faee27aca87cc729ab9c3521aef8ecc692f0d9539f7f1c4
                                                                                                • Instruction Fuzzy Hash: A8118274A0865D8FDB56DB18C8A96E977F0FF54301F0001A9C059D3262DF345985DB41
                                                                                                Function 00007FFD345EDB80 Relevance: .0, Instructions: 39COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 628845c786513ca985f72deb4e595c6f6685498e133f757842e045bc375865dc
                                                                                                • Instruction ID: be7a17f70b9578bc950c19b87ba8035a40ae851ea557399ce97d75e5a8f28b0d
                                                                                                • Opcode Fuzzy Hash: 628845c786513ca985f72deb4e595c6f6685498e133f757842e045bc375865dc
                                                                                                • Instruction Fuzzy Hash: C7E09BB114E50C6EA61C6A55AC479F7779CE787134F40012FE18EC5002F156B52382A5
                                                                                                Function 00007FFD345E39E9 Relevance: .0, Instructions: 33COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: dc8e43ff29f0614eb3889a9ca72635b88a8a7bf4e734753600d448e62ba9b495
                                                                                                • Instruction ID: e40e4d01573991853d4f13a46ae1559f58d7a76c1c874297e80fc0d17fede54a
                                                                                                • Opcode Fuzzy Hash: dc8e43ff29f0614eb3889a9ca72635b88a8a7bf4e734753600d448e62ba9b495
                                                                                                • Instruction Fuzzy Hash: 51E0D86170DC494FD790FA2CD496AA5BBD1FFA82203145AFBC04DC7695ED18E8854740
                                                                                                Function 00007FFD345E4FA5 Relevance: .0, Instructions: 33COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 062129874acede92b78e7110a33b018e416e4a391efbbb37ffc40a6684caf84a
                                                                                                • Instruction ID: e235f9f9c4598de12d318ffa90cdfdff2427ad4736d1812130bce589a3ae4e58
                                                                                                • Opcode Fuzzy Hash: 062129874acede92b78e7110a33b018e416e4a391efbbb37ffc40a6684caf84a
                                                                                                • Instruction Fuzzy Hash: C7E06D21A0DE950FDB67922C58A89A1BFE0DB6660070E01DAC559CB2A2D9099C968381
                                                                                                Function 00007FFD345E3A29 Relevance: .0, Instructions: 32COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 77094eb08aad7fed8660b999100b7763010af735471419a3fe0b48c1e2fc990a
                                                                                                • Instruction ID: 21ed3f2cff1851730afc26b36299bc26551731538d164f4c6859acba76a400f5
                                                                                                • Opcode Fuzzy Hash: 77094eb08aad7fed8660b999100b7763010af735471419a3fe0b48c1e2fc990a
                                                                                                • Instruction Fuzzy Hash: 5DF0A03680D68C5FCB42EB64E4A18DABFB0EE17320B0501C7E048CB053D7219A89CB82
                                                                                                Function 00007FFD345E4399 Relevance: .0, Instructions: 32COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 7801a0dcabbebd7ae3419e2ac655f0506237ab1ef4d4ddb1d3c9cb86bcb59ea7
                                                                                                • Instruction ID: ee46f6cf26499d9883a72add187b7956e17573b4b137db58bf7916ed983410eb
                                                                                                • Opcode Fuzzy Hash: 7801a0dcabbebd7ae3419e2ac655f0506237ab1ef4d4ddb1d3c9cb86bcb59ea7
                                                                                                • Instruction Fuzzy Hash: 5EF0F636E0C7894FE313AB74846A1EA7F71FF46200B9405FAD408CB293DE2C9948C741
                                                                                                Function 00007FFD345E05B1 Relevance: .0, Instructions: 30COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 55970235a7a63136307187942dcc1a99f1e0ac462fdb37a471903bb0937b1fcc
                                                                                                • Instruction ID: aa6d5b4351898b3b5adc7a3089582f2fe6e7c71a596a5f79226a56763f3e74e3
                                                                                                • Opcode Fuzzy Hash: 55970235a7a63136307187942dcc1a99f1e0ac462fdb37a471903bb0937b1fcc
                                                                                                • Instruction Fuzzy Hash: 79E0D82150F3D40FDB53973884988E13FA0DE2722030901EBD585CF073E518858AD741
                                                                                                Function 00007FFD345EC1B0 Relevance: .0, Instructions: 30COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: fc49e3631c42ef86b44f23aa6ef2fc84e81aebbbf474961f8234c96913dd7661
                                                                                                • Instruction ID: a9d04ea76e51729b5affb795010eba0b099909037aeaf28b40faf6447fa58fe9
                                                                                                • Opcode Fuzzy Hash: fc49e3631c42ef86b44f23aa6ef2fc84e81aebbbf474961f8234c96913dd7661
                                                                                                • Instruction Fuzzy Hash: 09F02763B0D3868EDA1BF23C18A12FC3751AF8322971803BED259D62D3ED1E6041A240
                                                                                                Function 00007FFD345E4715 Relevance: .0, Instructions: 28COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 9d252d42738c239f6605f81060482445a7baa5d3a02408ab65d5c43d54f82ba3
                                                                                                • Instruction ID: 64a30407d63de632aabea15ea4349bfef8916d7beb70162fcf30c1c646b26183
                                                                                                • Opcode Fuzzy Hash: 9d252d42738c239f6605f81060482445a7baa5d3a02408ab65d5c43d54f82ba3
                                                                                                • Instruction Fuzzy Hash: E7E02620F0EC680FDB67E62C74A89F93790DF1770030A01D6D418C72A6DD08EC8283C0
                                                                                                Function 00007FFD345E4E10 Relevance: .0, Instructions: 24COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: a74a3c4aa4766a9d80e2fa8b542751a0326d85b00d96fec1a640fe64b741d87e
                                                                                                • Instruction ID: 3c18aa697f587b6bcc5ed3e542e364e6b95b8ade3dec725d88a5992b85e172bb
                                                                                                • Opcode Fuzzy Hash: a74a3c4aa4766a9d80e2fa8b542751a0326d85b00d96fec1a640fe64b741d87e
                                                                                                • Instruction Fuzzy Hash: 75E08C19F4E60702FB6DA26565F13F660958F07302F0D40BAD519C10C9CD5D9CC0A152
                                                                                                Function 00007FFD345E28FF Relevance: .0, Instructions: 8COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 21426bade67f43c3124d9cf71bacc92dc056913d477db0a7c7fa3e1a30b9d51a
                                                                                                • Instruction ID: 89c5360c3ae49609b5b584fe0f489aab183de524291250c001e49cb88048620b
                                                                                                • Opcode Fuzzy Hash: 21426bade67f43c3124d9cf71bacc92dc056913d477db0a7c7fa3e1a30b9d51a
                                                                                                • Instruction Fuzzy Hash: B3C09B14F1B5474AF155FB2484E11BE21526F8F205B544435E11DD2196CD3DA5417545
                                                                                                Function 00007FFD345E2641 Relevance: .0, Instructions: 4COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: fdfdbbd83e645d49211a763a4d806cccd842304dd35c0c37a6fe5bcd052fc627
                                                                                                • Instruction ID: 94237d0e30678b1d802a0d9c2ebf4ad490fc08b173408107c6dfa08a5fd41c8b
                                                                                                • Opcode Fuzzy Hash: fdfdbbd83e645d49211a763a4d806cccd842304dd35c0c37a6fe5bcd052fc627
                                                                                                • Instruction Fuzzy Hash: 75A00204F0F91645E072B61444A11BE10410F5B600A244175E21DE11AACD1D698235D7

                                                                                                Non-executed Functions

                                                                                                Function 00007FFD345E1515 Relevance: 5.3, Strings: 4, Instructions: 333COMMON
                                                                                                Download Yara Rule
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: HQ-4$X:]4$`aI4$\/4
                                                                                                • API String ID: 0-2730856870
                                                                                                • Opcode ID: 608d4191f3dae1335ecf39556e3b4914fe3b4e78ddea9e741689a0ed37408522
                                                                                                • Instruction ID: c6c3bb46c1359bbc98fff72cb9132b4879a34204c599d5b452c47965a3cec209
                                                                                                • Opcode Fuzzy Hash: 608d4191f3dae1335ecf39556e3b4914fe3b4e78ddea9e741689a0ed37408522
                                                                                                • Instruction Fuzzy Hash: EC911862F0DD494FEB99EA2C98A55FA33C1EF96314B58007EE44ED3293DD29F8428741
                                                                                                Function 00007FFD345E1715 Relevance: 5.2, Strings: 4, Instructions: 196COMMON
                                                                                                Download Yara Rule
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: @*K4$h,K4$h6K4$5K4
                                                                                                • API String ID: 0-206420677
                                                                                                • Opcode ID: b0839e3a9d42e129c05b4651d187273ff4c959b9de77a6fab91bb9d4dab022c8
                                                                                                • Instruction ID: eebb7e643ad385820817d9af964d9e5e9630e6995d6403dc64997e9fbb272c47
                                                                                                • Opcode Fuzzy Hash: b0839e3a9d42e129c05b4651d187273ff4c959b9de77a6fab91bb9d4dab022c8
                                                                                                • Instruction Fuzzy Hash: 3E511963F1ED4A0FEBA6EA1C84A66F633D1EF59310B08017AD54ED7196DC2DE8478740
                                                                                                Function 00007FFD345E8069 Relevance: 5.1, Strings: 4, Instructions: 60COMMON
                                                                                                Download Yara Rule
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: 4$H$X]4$0]4
                                                                                                • API String ID: 0-1718455487
                                                                                                • Opcode ID: 9aec8ef65327fc8a9b5bf5d01b1e377950bc3815e0558f67def62b17c5cd0f6a
                                                                                                • Instruction ID: 66e3748c260605c35087a75361e3de0eea3235b5ac60d9e9bbc83a58705e74dd
                                                                                                • Opcode Fuzzy Hash: 9aec8ef65327fc8a9b5bf5d01b1e377950bc3815e0558f67def62b17c5cd0f6a
                                                                                                • Instruction Fuzzy Hash: 52112393E0EAC50FEBA6DA2C08E11D13BD1EF67250B1C40EFD098CB1D3D918A80983A1
                                                                                                Function 00007FFD345E8080 Relevance: 5.1, Strings: 4, Instructions: 52COMMON
                                                                                                Download Yara Rule
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000009.00000002.3417225232.00007FFD345E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD345E0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_9_2_7ffd345e0000_ScreenConnect.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: 4$H$X]4$0]4
                                                                                                • API String ID: 0-1718455487
                                                                                                • Opcode ID: 5a7d76bdab401c81068f63e498cdef277a0a500b65aaa86246bcda4aca060d07
                                                                                                • Instruction ID: 081f158ee886b08853cb748716d70c9d84703c4c6df72cc848260624e3642e3d
                                                                                                • Opcode Fuzzy Hash: 5a7d76bdab401c81068f63e498cdef277a0a500b65aaa86246bcda4aca060d07
                                                                                                • Instruction Fuzzy Hash: 36014553F0E9850BEBA6DE2C04D05A22BC1DF96654B1841BEE45CCB182CD18B8098390